- Disabling security groups and network ACLs
- Using IAM roles instead of embedding access keys in the instance
- Allowing all inbound and outbound traffic by default
- Storing sensitive data on the instance root volume