Least privilege for Terraform service accounts - Cheat Sheet & Quick Revision

Recall & Review

beginner

What does 'least privilege' mean for Terraform service accounts?

It means giving the service account only the permissions it needs to do its job, and nothing more. This reduces security risks.

beginner

Why should Terraform service accounts avoid using overly broad permissions?

Because broad permissions can allow accidental or malicious changes beyond what Terraform needs, increasing risk of damage.

intermediate

How can you implement least privilege for a Terraform service account in cloud providers?

By assigning only specific roles or permissions that match the Terraform tasks, such as managing compute instances or storage buckets, and nothing extra.

intermediate

What is a best practice for managing Terraform service account credentials?

Store credentials securely using secret managers or environment variables, and rotate them regularly to reduce risk.

beginner

How does least privilege improve Terraform infrastructure management?

It limits the chance of accidental or harmful changes, making infrastructure safer and easier to audit.

What is the main goal of least privilege for Terraform service accounts?

A Assign only necessary permissions for Terraform tasks

B Give full admin access to speed up deployment

C Allow all permissions to avoid errors

D Use personal user accounts instead

Least privilege means giving only the permissions needed, not full or all permissions.

Which of these is a good practice for Terraform service account permissions?

A Share credentials with multiple users

B Use broad roles like Owner or Admin

C Assign roles based on specific resource needs

D Avoid using service accounts

Assigning roles based on specific needs follows least privilege and improves security.

How should Terraform service account credentials be stored?

A In plain text files on developer machines

B Shared via email

C Hardcoded in Terraform code

D In secure secret managers or environment variables

Secure storage like secret managers protects credentials from unauthorized access.

What risk does giving excessive permissions to Terraform service accounts create?

A Reduced auditability

B Increased security

C Faster deployments

D No risk at all

Excessive permissions make it harder to track changes and increase risk of mistakes or attacks.

Which principle helps keep Terraform infrastructure safe?

A Random privilege

B Least privilege

C No privilege

D Maximum privilege

Least privilege limits permissions to what is necessary, improving safety.

Explain how to apply least privilege to a Terraform service account in a cloud environment.

Think about limiting permissions and protecting credentials.

Describe why least privilege is important for Terraform service accounts and what risks it helps prevent.

Consider security and control benefits.