Least privilege principle in AWS - Step-by-Step Execution

Process Flow - Least privilege principle

Start: User/Service needs access

↓

Define minimum permissions needed

↓

Create policy with only those permissions

↓

Attach policy to user/service

↓

Access request made

↓

AWS checks policy permissions

↓

Allow if permission exists, else deny

↓

End: Access granted or denied

This flow shows how AWS grants access only if the user or service has the minimum permissions defined in their policy, following the least privilege principle.

Execution Sample

AWS

1. Define IAM policy with minimal permissions
2. Attach policy to user
3. User tries to access S3 bucket
4. AWS checks policy
5. Access allowed or denied

This example traces how AWS evaluates a user's access request based on a minimal permission policy.

Process Table

Step	Action	Policy Permissions	Access Requested	AWS Decision	Result
1	Define policy	s3:GetObject on bucket 'my-bucket'	-	-	Policy created with minimal S3 read permission
2	Attach policy	s3:GetObject on bucket 'my-bucket'	-	-	Policy attached to user
3	User requests access	s3:GetObject on bucket 'my-bucket'	s3:GetObject on 'my-bucket/file.txt'	Check if permission exists	Permission found
4	AWS evaluates	s3:GetObject on bucket 'my-bucket'	s3:GetObject on 'my-bucket/file.txt'	Allow	Access granted
5	User requests access	s3:GetObject on bucket 'my-bucket'	s3:DeleteObject on 'my-bucket/file.txt'	Check if permission exists	Permission not found
6	AWS evaluates	s3:GetObject on bucket 'my-bucket'	s3:DeleteObject on 'my-bucket/file.txt'	Deny	Access denied

💡 Access is granted only when requested action matches permissions; denied otherwise.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 5	Final
Policy Permissions	None	s3:GetObject on 'my-bucket'	Attached to user	Checked for s3:GetObject	Checked for s3:DeleteObject	Final permissions unchanged
Access Requested	None	None	None	s3:GetObject on 'my-bucket/file.txt'	s3:DeleteObject on 'my-bucket/file.txt'	Varies per request
AWS Decision	None	None	None	Allow	Deny	Depends on permission match

Key Moments - 2 Insights

Why is access denied when the user tries to delete an object even though they can read it?

Because the policy only grants 's3:GetObject' permission, not 's3:DeleteObject'. AWS denies actions not explicitly allowed, as shown in steps 5 and 6.

Can a user access resources not mentioned in their policy?

No. AWS only allows actions explicitly listed in the policy. If the action is missing, AWS denies access, ensuring least privilege, as seen in the denied delete request.

Visual Quiz - 3 Questions

Look at the execution table, what permission does the policy grant after step 1?

A s3:DeleteObject on 'my-bucket'

B s3:GetObject on 'my-bucket'

C Full access to all S3 buckets

D No permissions

💡 Hint

Check the 'Policy Permissions' column at step 1 in the execution table.

At which step does AWS deny access due to missing permission?

A Step 6

B Step 3

C Step 5

D Step 4

💡 Hint

Look for 'Deny' in the 'AWS Decision' column in the execution table.

If the policy also included 's3:DeleteObject', how would the result at step 6 change?

A Access would still be denied

B AWS would ignore the new permission

C Access would be granted

D User would be blocked from all actions

💡 Hint

Refer to how AWS checks permissions in steps 3 and 4 for allowed actions.

Concept Snapshot

Least Privilege Principle in AWS:
- Grant only the permissions needed.
- Define minimal IAM policies.
- Attach policies to users/services.
- AWS allows actions only if explicitly permitted.
- Deny all other actions by default.

Full Transcript

The least privilege principle means giving users or services only the permissions they need to do their job. In AWS, you create an IAM policy that lists just those permissions. Then you attach this policy to the user or service. When the user tries to do something, AWS checks if the action is allowed by the policy. If yes, access is granted; if not, access is denied. This keeps your cloud resources safer by limiting what each user or service can do.