AWS IAM Least Privilege Without Losing Your Mind
Least privilege is the IAM principle everyone agrees with and few actually implement, because doing it by hand is tedious and "Action": "*" always works. Here's a practical approach that gets you most of the way without turning into a full-time job. Why it matters An over-permissive role is a standing risk: if the credentials leak or a service is compromised, the blast radius is everything that…
Least privilege is a principle in Identity and Access Management (IAM) that everyone agrees with, yet few organizations fully implement because it can be quite tedious. The article provides a practical approach to achieve least privilege without it becoming an all-consuming task.
Firstly, begin with a deny-all policy and add only the permissions that the workload actually uses. To identify these permissions, you can use tools like CloudTrail and IAM Access Analyzer to generate a policy from observed activity. Run the workload in a non-production account with a broad policy, allow it to exercise its paths, and then generate a scoped policy based on what it actually used. For new workloads, add permissions iteratively as you encounter AccessDenied errors.
Secondly, scope resources rather than just actions. For example, instead of granting s3:GetObject on * (which means every object in every bucket), specify the exact resource like arn:aws:s3:::my-app-bucket/*.
Thirdly, use conditions to tighten the policy further. Conditions are often underutilized. You can restrict the policy by region, source VPC, MFA presence, tags, or time. For instance, a policy that only works from a specific VPC over TLS is safer than one that works from anywhere.
Fourthly, prefer IAM roles over long-lived keys for your workloads. Use IAM roles (instance profiles, IRSA for EKS, task roles for ECS) for your AWS workloads and OIDC federation for CI/CD and external systems. Humans should use IAM Identity Center (SSO) with short-lived sessions, not IAM users.
Fifthly, implement guardrails above the role using Service Control Policies (SCPs) at the AWS Organizations level. These SCPs set hard ceilings like denying CloudTrail disabling or preventing access outside approved regions.
Lastly, regularly identify and fix over-privileged roles using tools like IAM Access Analyzer and the IAM console's last accessed data. Alert on new iam:* and *:* policies in CI with tools like tfsec/checkov.
Avoid common traps like using Action: * on Resource: *, iam:PassRole with Resource: *, or NotAction policies. Instead, use explicit Action allow-lists.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
