CodePark/ questions / IAM, roles & policies
START PRACTICINGPRACTICE
Backend question · Cloud & AWS › IAM, roles & policies

What does least privilege mean in IAM? Review this policy for a service that only reads invoices from one bucket, and explain how you would arrive at a tight policy in practice.

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "s3:*",
    "Resource": "*"
  }]
}

Least privilege means you give a principal only the actions and resources it needs, and nothing more. A principal is the user, role or service that makes the request.

This policy allows every S3 action on every bucket in the account. That includes deletes and bucket policy changes. So a bug or a stolen credential could wipe or expose all your data.

A tight version allows:

  • s3:GetObject on arn:aws:s3:::my-bucket/invoices/*.
  • s3:ListBucket on the bucket ARN, with a prefix condition, but only if the service lists keys.

Note the difference: object actions use the object ARN, and listing uses the bucket ARN. An ARN (Amazon Resource Name) is the unique ID of an AWS resource.

In practice:

  • Start narrow, and add a permission when something fails.
  • Give each service its own role.
  • Use IAM Access Analyzer. It can generate a policy from the activity recorded in CloudTrail (the AWS log of API calls), and it flags unused permissions.
  • Review permissions regularly.
  • Grant only the actions and resources the principal needs.
  • Wildcard actions and resources turn any bug or leaked credential into a full compromise.
  • Object actions use object ARNs, but s3:ListBucket uses the bucket ARN.
  • Give each service its own role, start narrow and widen only when needed.
  • IAM Access Analyzer can generate policies from CloudTrail activity and find unused access.