TOPIC SECURITY
Least Privilege the default should be 'no'
IN 10 SECONDS
The security principle that users, programs, and service roles should only be granted the minimum necessary permissions to perform their tasks, and nothing more.
GOTCHA Attaching AdministratorAccess to service roles makes development fast but leaves you open to massive damage if credentials are compromised.
HOW PRIVILEGE IS RESTRICTED
01 Baseline deny new service account starts with zero permissions (default block).
02 Audit run operator reviews requirements: this service only needs to write log files.
03 Scope grant attaches a policy granting write-only access to log storage folder.
04 Audit loop monitors permissions periodically, removing unused access codes.
POKE IT YOURSELF
aws iam generate-service-last-accessed-details --arn arn:aws:iam::... — find unused permissions on an IAM role
Drill this topic →
~65 sec read