How do you approach security and access management on AWS?

Lead with identity and least privilege.

• Never use the root account for daily work. Enable MFA on it, remove its access keys, and lock it away.
• No long-lived IAM user access keys where they can be avoided. Use IAM roles — for EC2 instances, Lambda functions, and ECS tasks — so credentials are temporary and rotated automatically. For humans, federate through IAM Identity Center or your existing identity provider rather than creating IAM users.
• Least privilege, built iteratively. Start restrictive and expand from Access Analyzer findings and CloudTrail evidence of what was actually used, rather than granting broad access and intending to tighten it later.
• Multi-account structure with AWS Organizations — separate accounts for production, development, and shared services, with Service Control Policies setting guardrails. Account boundaries are the strongest isolation AWS offers.
• Secrets in Secrets Manager or Parameter Store, never in code, environment variables in a repository, or an AMI.
• Encryption at rest with KMS and in transit with TLS, as a default rather than an exception.
• Detection — CloudTrail enabled everywhere and shipped to a separate account, plus GuardDuty and Security Hub.

Note: Saying you would enforce standards with SCPs and automated checks rather than documentation is what separates someone who has operated a real AWS estate.