CodeParkLeast privilege means each part of the system gets only the permissions it needs, and nothing more. Then one bug or one stolen credential can do only a little damage. This damage area is called the blast radius.
Database:
- The app's user doesn't own the tables and isn't a superuser.
- Migrations run with a separate role, so the running app can't drop tables.
- Reporting tools use a read-only role.
- Each service has its own database user.
Cloud:
- Each service has its own IAM role, not a shared admin key.
- Permissions name exact actions and resources, for example
s3:GetObjecton one bucket path. - Use roles and short-lived credentials instead of long-lived access keys.
Runtime:
- Run containers as a non-root user, with a read-only file system.
- Drop Linux capabilities you don't need.
- Use network policies to limit which services can talk to each other and to the internet.
People: give admin access only when it's needed, require MFA, and review access regularly.
Example: an SSRF bug steals the server's cloud credentials. If that role can only read one bucket path, the attacker gets little. If it's an admin role, they get your whole account.
- Least privilege gives each component only the permissions it needs.
- The app's database user shouldn't own tables, and migrations use a separate role.
- Each service gets its own narrow IAM role with short-lived credentials.
- Containers run as non-root, with a read-only file system and limited network access.
- Least privilege limits the blast radius of a bug or a stolen credential.