2.1.1.2. Principle of Least Privilege

2.1.1.2. Principle of Least Privilege

💡 First Principle: The Principle of Least Privilege (PoLP) grants only the minimum permissions needed for a user or service to perform its task, reducing the attack surface and limiting the impact of a breach.

The Principle of Least Privilege (PoLP) grants only the minimum permissions needed for a user or service to perform its task. This reduces the attack surface and limits the impact of a breach.

PoLP is a fundamental security best practice. Instead of granting broad access (e.g., full administrator access), you grant only the specific permissions required for an IAM identity to perform its intended function.

Key Aspects of PoLP:

• Minimal Permissions: Grant only what's necessary.
• Reduced Attack Surface: Fewer ways for attackers to exploit privileges.
• Limited Blast Radius: If a credential is compromised, impact is contained.
• Auditable: Easier to audit and understand access patterns.

Least-privilege techniques the exam expects:

• Scope actions AND resources: Name the exact API actions (e.g. sqs:ReceiveMessage, dynamodb:PutItem) on the exact ARNs — narrowing only one of the two still over-grants.
• Match each action to the right ARN level: S3 bucket-level actions such as s3:ListBucket apply to the bucket ARN (arn:aws:s3:::my-bucket); object-level actions such as s3:GetObject and s3:PutObject apply to object ARNs (arn:aws:s3:::my-bucket/*). A mismatched pair grants nothing.
• Condition keys for item-level limits: DynamoDB fine-grained access control uses the dynamodb:LeadingKeys condition key to restrict a principal to items whose partition key matches a given value (e.g. its own user ID).
• Permissions boundaries: A managed policy set as the maximum permissions an IAM user or role can have; effective permissions are the intersection of the boundary and the identity policies. To delegate role creation safely, allow iam:CreateRole only with an iam:PermissionsBoundary condition that forces the approved boundary onto every new role. (An SCP caps whole accounts in an Organization; a boundary caps individual identities.)

Scenario: An IAM user is responsible for managing S3 backups. Instead of granting AmazonS3FullAccess to all S3 resources, the IAM policy should only allow s3:PutObject and s3:GetObject permissions on a specific backup bucket.

Visual: Principle of Least Privilege

⚠️ Common Pitfall: Granting * (all actions) on * (all resources) just to get something working quickly, leading to massive security holes.

Key Trade-Offs:

• Security (Least Privilege) vs. Administrative Overhead: Implementing least privilege requires more time and knowledge to craft precise policies, but it's a critical security control.

Reflection Question: How does applying PoLP to an AWS Lambda function's execution role (granting it only access to specific resources it needs) fundamentally enhance your serverless application's security posture?