Least privilege principle in AWS - Commands & Configuration

Introduction

Giving users or programs only the permissions they need helps keep systems safe. This stops accidental or harmful actions by limiting access.

When creating a new user or role that needs access to AWS services.

When setting permissions for an application to access only required resources.

When you want to reduce the risk of accidental data loss or security breaches.

When auditing existing permissions to improve security.

When granting temporary access to contractors or external partners.

Config File - least_privilege_policy.json

least_privilege_policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:s3:::example-bucket",
        "arn:aws:s3:::example-bucket/*"
      ]
    }
  ]
}

This JSON file defines a policy that allows listing and reading objects only from a specific S3 bucket named example-bucket. It does not allow any other actions or access to other buckets. This follows the least privilege principle by granting only the permissions needed.

Commands

This command creates a new IAM policy named ExampleS3ReadOnlyPolicy using the permissions defined in the JSON file. It sets up the least privilege permissions for S3 read access.

Terminal

aws iam create-policy --policy-name ExampleS3ReadOnlyPolicy --policy-document file://least_privilege_policy.json

Expected Output

{

    "Policy": {

        "PolicyName": "ExampleS3ReadOnlyPolicy",

        "PolicyId": "ABCDEFGHIJKLMN1234567",

        "Arn": "arn:aws:iam::123456789012:policy/ExampleS3ReadOnlyPolicy",

        "Path": "/",

        "DefaultVersionId": "v1",

        "AttachmentCount": 0,

        "PermissionsBoundaryUsageCount": 0,

        "IsAttachable": true,

        "CreateDate": "2024-06-01T12:00:00Z",

        "UpdateDate": "2024-06-01T12:00:00Z"

    }

}

→

--policy-name - Sets the name of the new IAM policy.

→

--policy-document - Specifies the JSON file with the policy permissions.

This command attaches the newly created least privilege policy to a user named example-user, giving them only the permissions defined in the policy.

Terminal

aws iam attach-user-policy --user-name example-user --policy-arn arn:aws:iam::123456789012:policy/ExampleS3ReadOnlyPolicy

Expected Output

No output (command runs silently)

→

--user-name - Specifies the IAM user to attach the policy to.

→

--policy-arn - Specifies the ARN of the policy to attach.

This command lists all policies attached to example-user to verify the correct policy is attached.

Terminal

aws iam list-attached-user-policies --user-name example-user

Expected Output

{

    "AttachedPolicies": [

        {

            "PolicyName": "ExampleS3ReadOnlyPolicy",

            "PolicyArn": "arn:aws:iam::123456789012:policy/ExampleS3ReadOnlyPolicy"

        }

    ]

}

→

--user-name - Specifies the IAM user to check.

Key Concept

If you remember nothing else from this pattern, remember: always give only the exact permissions needed, nothing more.

Common Mistakes

Giving users full access instead of limited permissions.

This increases risk by allowing accidental or malicious actions beyond what is needed.

Create and attach policies that specify only the required actions and resources.

Using wildcard (*) permissions for actions or resources.

Wildcards grant broad access, defeating the purpose of least privilege.

Specify exact actions and resource ARNs in the policy.

Not verifying which policies are attached to users or roles.

You might think permissions are limited when they are not, causing security gaps.

Use commands to list attached policies and audit permissions regularly.

Summary

Create a JSON policy file that defines only the needed permissions.

Use AWS CLI to create the policy and attach it to users or roles.

Verify attached policies to ensure least privilege is enforced.

Practice

1. What does the least privilege principle mean in AWS security?

easy

A. Users get only the permissions they need to do their job

B. Users get full access to all AWS services

C. Users share passwords to access resources

D. Users can access resources without authentication

Solution

1. Step 1: Understand the principle meaning

   The least privilege principle means giving users only the minimum permissions they need.

2. Step 2: Compare options to principle

   Only Users get only the permissions they need to do their job matches this by limiting permissions to what is needed.

3. Final Answer:

   Users get only the permissions they need to do their job -> Option A

4. Quick Check:

   Least privilege = minimal needed access [OK]

Hint: Least privilege means minimum permissions needed [OK]

Common Mistakes:

• Thinking least privilege means full access
• Confusing least privilege with no access
• Assuming password sharing is secure

2. Which IAM policy snippet follows the least privilege principle for allowing S3 read-only access to a specific bucket my-bucket?

easy

A. {\"Effect\": \"Allow\", \"Action\": [\"s3:DeleteObject\"], \"Resource\": \"arn:aws:s3:::my-bucket/*\"}

B. {\"Effect\": \"Allow\", \"Action\": \"s3:*\", \"Resource\": \"*\"}

C. {\"Effect\": \"Allow\", \"Action\": [\"s3:GetObject\"], \"Resource\": \"arn:aws:s3:::my-bucket/*\"}

D. {\"Effect\": \"Allow\", \"Action\": [\"ec2:StartInstances\"], \"Resource\": \"*\"}

Solution

1. Step 1: Identify required permissions for read-only S3 access

   Read-only means allowing only s3:GetObject on the specific bucket's objects.

2. Step 2: Match policy actions and resources

   {\"Effect\": \"Allow\", \"Action\": [\"s3:GetObject\"], \"Resource\": \"arn:aws:s3:::my-bucket/*\"} allows only s3:GetObject on my-bucket objects, following least privilege.

3. Final Answer:

   Policy allowing only s3:GetObject on my-bucket objects -> Option C

4. Quick Check:

   Least privilege = specific action + resource [OK]

Hint: Allow only needed actions on specific resources [OK]

Common Mistakes:

• Using wildcard * for all actions or resources
• Allowing delete or write actions unnecessarily
• Granting permissions for unrelated services

3. Given this IAM policy snippet, what is the effective permission granted?

{
  "Effect": "Allow",
  "Action": ["s3:PutObject", "s3:GetObject"],
  "Resource": "arn:aws:s3:::example-bucket/*"
}

medium

A. Denies all access to example-bucket

B. Allows uploading and downloading objects only in example-bucket

C. Allows full access to all S3 buckets

D. Allows deleting objects in example-bucket

Solution

1. Step 1: Analyze actions in the policy

   The policy allows s3:PutObject (upload) and s3:GetObject (download) actions.

2. Step 2: Check resource scope

   The resource is limited to objects inside example-bucket, so permissions apply only there.

3. Final Answer:

   Allows uploading and downloading objects only in example-bucket -> Option B

4. Quick Check:

   Actions + resource = upload/download in example-bucket [OK]

Hint: Check actions and resource ARN carefully [OK]

Common Mistakes:

• Assuming delete permission is included
• Thinking permissions apply to all buckets
• Confusing allow with deny

4. You created an IAM policy to allow only starting EC2 instances but users report they can also stop instances. What is the likely mistake?

medium

A. The users have an additional policy granting stop permissions

B. The policy includes both ec2:StartInstances and ec2:StopInstances actions

C. The policy is attached to the wrong user

D. The policy uses wildcard * for all EC2 actions

Solution

1. Step 1: Understand the reported behavior

   Users can stop instances, which is not intended by the new policy.

2. Step 2: Identify possible causes

   If the policy only allows starting, but users can stop, they likely have another policy granting stop permissions.

3. Final Answer:

   Users have an additional policy granting stop permissions -> Option A

4. Quick Check:

   Multiple policies combine permissions [OK]

Hint: Check all policies attached to users [OK]

Common Mistakes:

• Assuming one policy overrides others
• Not checking group or role policies
• Ignoring policy wildcards

5. You want to apply the least privilege principle for a developer who needs to manage Lambda functions but only in the dev-environment. Which approach is best?

hard

A. Give the developer admin access to manage Lambda

B. Create an IAM policy allowing all Lambda actions on all functions

C. Attach the AWS managed policy AWSLambdaFullAccess to the developer

D. Create an IAM policy allowing only Lambda actions on functions with resource ARN containing dev-environment

Solution

1. Step 1: Identify the scope of access needed

   The developer needs to manage Lambda functions only in the dev-environment.

2. Step 2: Apply least privilege by limiting actions and resources

   Create an IAM policy allowing only Lambda actions on functions with resource ARN containing dev-environment restricts Lambda actions to only functions in dev-environment, minimizing risk.

3. Step 3: Evaluate other options

   Options B, C, and D grant broader access than needed, violating least privilege.

4. Final Answer:

   Create an IAM policy allowing only Lambda actions on functions with resource ARN containing dev-environment -> Option D

5. Quick Check:

   Least privilege = limit actions + resource scope [OK]

Hint: Limit permissions by resource tags or names [OK]

Common Mistakes:

• Using broad AWS managed policies
• Granting admin or full access unnecessarily
• Ignoring resource-level restrictions