Guide · Security
IAM Least Privilege Example: AWS Simple
IAM least privilege means granting only the permissions each role needs. Here's a simple example and how to apply it.
Least privilege is mandatory—especially for agent and automation identities. Primary control: Authorization
One admin key is one phishing away from everything
Least privilege means each role gets only the actions and resources it needs. `AdministratorAccess` "just works" until a phished developer key can wipe data, mint IAM users, and spend. APRF Authorization expects scoped identities for humans, CI, and agents alike.
A team shared one full-admin IAM user across developers and CI. After phishing, the attacker owned the account. Rotating everything and rebuilding trust cost more than writing two scoped roles would have.
A minimal shape
Prefer a role per workload—e.g. `lambda-api-role` that may `lambda:InvokeFunction` on its functions and `s3:GetObject` on `arn:aws:s3:::my-bucket/`—not `s3:` on ``.
Add conditions (MFA, source VPC, tags) where they fit. Run IAM Access Analyzer and the policy simulator before attach. Review quarterly; delete unused policies.
Agents and automation
Do not reuse human admin roles for MCP tools or CI. Separate identities, separate blast radius—same Authorization story as Tool Safety.
Next: Authorization
Open the related pillar specification for mandatory checks, artifacts, and pass conditions. Self-attest is optional.
Related
Frequently asked questions
- What is IAM least privilege?
- Least privilege means granting each IAM role or user only the permissions it needs—no more. This limits blast radius if a key is compromised and is required for compliance.
- How do I implement least privilege in AWS?
- Create separate roles per service. Use custom policies with specific actions and resource ARNs. Avoid wildcards. Use IAM Access Analyzer to find overly permissive policies.
- Why is admin access dangerous?
- Admin access grants full control over your AWS account. A single compromised key can delete resources, exfiltrate data, or create new resources for abuse. Always use scoped roles instead.