Least privilege means granting an identity only the permissions it needs, for only as long as it needs them. In cloud environments the principle is simple to articulate but difficult to sustain, because permissions accumulate faster than they are removed.
Three questions for every grant
- Who is the principal? A human, a workload, or a federated identity? Each has a different lifecycle and a different appropriate blast radius.
- What actions and resources? Prefer specific actions on specific resource ARNs over wildcards. Wildcards are convenient and quietly dangerous.
- Under what conditions? Condition keys, source network, time, MFA, resource tags, turn a broad grant into a narrow, auditable one.
Operating the model
Least privilege is not a one-time configuration; it is a feedback loop. Start from deny, grant what is observed to be needed, and continuously prune what is unused. Access analyzers and last-used data make the pruning step tractable.