Least Privilege

Least Privilege is the foundational security principle that every identity (user, role, service) should have only the minimum permissions required to perform its intended function. Nothing more.

In AWS, this means writing IAM policies that specify exact actions on exact resources instead of using wildcards. A Lambda function that reads from one S3 bucket should have s3:GetObject on that specific bucket ARN - not s3:* on *.

Why It Matters

• Blast radius reduction: if credentials are compromised, the attacker can only do what that identity was allowed to do
• Compliance requirement: CIS, SOC 2, PCI DSS, and HIPAA all require least-privilege access
• Audit clarity: narrow policies make it clear who can do what

AWS Tools for Least Privilege

• IAM Access Analyzer: generates policies based on actual usage from CloudTrail logs
• IAM Access Advisor: shows which services an identity has accessed and when
• Permission boundaries: set maximum permissions regardless of what policies are attached
• SCPs: enforce guardrails at the organization level