IAM Least Privilege Example: AWS Simple
IAM least privilege means granting only the permissions each role needs. Here's a simple example and how to apply it.
What this problem means
Least privilege means each IAM role or user gets only the permissions needed for its job—nothing more. The opposite is broad roles (e.g., AdministratorAccess) that "just work" but create massive blast radius if compromised.
Why this is dangerous
- Blast radius: A compromised key with admin access can delete resources, exfiltrate data, or rack up bills.
- Compliance: SOC2, ISO 27001, and customers expect least privilege.
- Audit failures: Overly permissive IAM is a common finding in security reviews.
Real-world example
A startup used a single IAM user with full admin for all developers and CI/CD. When a developer's key was phished, the attacker had access to everything—databases, S3 buckets, IAM itself. They had to rotate all credentials and rebuild trust. Least privilege would have limited the damage to a single service.
How to fix it
1. Create role per service: e.g., `lambda-api-role` that can only invoke Lambda and read from a specific S3 bucket.
2. Avoid wildcards: Prefer `s3:GetObject` on `arn:aws:s3:::my-bucket/*` over `s3:*` on `*`.
3. Use conditions: Restrict by IP, MFA, or resource tags where possible.
4. Review regularly: Audit permissions quarterly. Remove unused roles and policies.
Tools and configurations
- AWS IAM: Create custom policies with minimal actions and resources.
- IAM Access Analyzer: Identifies overly permissive policies.
- Policy simulator: Test what a policy allows before attaching.
Common mistakes
- Using `*` for actions or resources.
- One role for all services.
- Never reviewing or tightening permissions.
Quick checklist
- [ ] Create separate roles per service or function
- [ ] Use specific resource ARNs, not wildcards
- [ ] Run IAM Access Analyzer
- [ ] Review and remove unused permissions quarterly
Need help with production readiness? Get a free 30-minute audit.
Book Free 30-Min Production AuditCheck if your system has this risk
Take the 60-second production readiness assessment to identify gaps in your infrastructure.
Start AssessmentFrequently asked questions
- What is IAM least privilege?
- Least privilege means granting each IAM role or user only the permissions it needs—no more. This limits blast radius if a key is compromised and is required for compliance.
- How do I implement least privilege in AWS?
- Create separate roles per service. Use custom policies with specific actions and resource ARNs. Avoid wildcards. Use IAM Access Analyzer to find overly permissive policies.
- Why is admin access dangerous?
- Admin access grants full control over your AWS account. A single compromised key can delete resources, exfiltrate data, or create new resources for abuse. Always use scoped roles instead.