Separate who can grant from who can act
In many apps, anyone with an “admin” role can both use privileged actions and hand those same powers to other people. That mixes two different privileges: Acting with a permission (delete a project, export data, approve a payment) Granting that permission to someone else If the same role covers both, a compromised admin account — or a confused admin — can quietly expand the blast radius. The…
In numerous applications, individuals wielding an "admin" role possess the ability to execute privileged actions and subsequently grant those identical powers to others. This amalgamation of two distinct privileges poses a significant security risk: acting with a specific permission (such as deleting a project, exporting data, or approving a payment), and simultaneously granting that permission to another individual.
When a single role encompasses both functionalities, a compromised or misguided admin account can inadvertently expand the attack surface. Rather than necessitating the discovery of all secret keys, an attacker can simply generate new admin accounts. A more secure approach involves adhering to the principle of separation of duties.
By isolating day-to-day privileged actions to an operator or admin role, and confining permission grants, role assignments, and policy edits to a smaller grantor or IAM role, the risk of unauthorized escalation is significantly mitigated. Moreover, it is crucial to mandate an additional layer of authentication, approval, or impose a time constraint for grant actions.
Separating audit events for grant actions from regular use events further enhances the overall security posture. In essence, authorization transcends the binary query, "Can this user perform action X at this moment?", and encompasses the broader question, "Who is authorized to alter the answer to that inquiry?"
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
