Root MFA, temporary credentials, CloudTrail, GuardDuty, and account-level S3 controls: the security baseline to finish in the first hour of a new AWS account.