1) minimize your attack surface, only service ports allowed, use a load balancer if available, your security groups can be restricted to your IP address. Better yet you can deploy in a private subnet and use tailscale or a bastion host. 2) automatic security updates (unattended-upgrades on Debian based, yum-cron on rhel based) 3) use ssh keys and named accounts. Disable root and default logins (on aws the default account is ec2-user on Amazon linux and Ubuntu for Ubuntu images) 4) on aws trusted advisor recommends some good account hardening steps.