Least-Privilege AWS IAM for Small Teams: Permission Boundaries, Access Analyzer, and Terraform

Small teams often struggle with IAM access management. One person becomes an admin bottleneck, or everyone gets AdministratorAccess initially and never reverts it. Permission boundaries provide a middle ground: developers can create and manage their own roles, but no role can exceed a defined ceiling. Combine permission boundaries with IAM Access Analyzer for least privilege without a dedicated security team.

A permission boundary is a managed policy attached to a user or role, setting the maximum permissions. Effective permissions are the intersection of identity policies, the permission boundary, minus any explicit denies or SCPs. If the boundary allows an action but the role's policy restricts it, the role only gets the allowed action. Conversely, if the role's policy grants an action not allowed by the boundary, the role gets no access to that action.

To implement permission boundaries, create a boundary policy that allows typical application services while blocking privilege escalation and preventing modification of the boundary itself. Replace the account ID with your specific account ID. Set the path scoping to role/app/* so developer-created roles can't access break-glass or CI roles elsewhere.

Use the iam:PermissionsBoundary condition in CreateRole, PutRolePolicy, and AttachRolePolicy actions, allowing these only when the target role carries the exact boundary. Limit PassRole to the /app/ path, allowing developers to hand roles to Lambda or ECS but preventing unintended policy attachments.