Sign in Get started

Cloud Computing Tutorial · Identity and Security · Lesson 8 of 24

Least Privilege and Temporary Credentials

Grant only what's needed, use roles and federation instead of keys, and find unused permissions.

Create a free account to save this page, take notes and track your progress. Sign in

Why least privilege matters

If an application with AdministratorAccess is compromised (a vulnerable dependency, an SSRF bug), the attacker gets the whole account. With least privilege, they get only what that application could do.

In practice

  1. Start from what the workload does: "read objects under uploads/ in one bucket, write to one queue".
  2. Scope resources by ARN and use conditions, not "Resource": "*".
  3. Use temporary credentials everywhere:
    • people: SSO (IAM Identity Center, Entra ID, Google Workspace/Cloud Identity) with MFA;
    • CI/CD: OIDC federation (GitHub Actions to an IAM role, Azure workload identity federation, Google Workload Identity Federation);
    • workloads: roles and managed identities.
  4. Remove unused permissions: IAM Access Analyzer can generate policies from actual CloudTrail activity and report unused access; Azure and Google Cloud have similar recommenders.
Shrink a policy to what's actually usedTry it yourself
granted = {"s3:*", "dynamodb:*", "sqs:*", "iam:PassRole", "ec2:*"}
used_last_90_days = ["s3:GetObject", "s3:PutObject", "sqs:SendMessage", "s3:GetObject", "sqs:SendMessage"]

used = sorted(set(used_last_90_days))
unused_services = sorted({g.split(":")[0] for g in granted} - {u.split(":")[0] for u in used})
print("actions actually used:", used)
print("services granted but never used:", unused_services)
print("suggested policy actions:", used)

Output

actions actually used: ['s3:GetObject', 's3:PutObject', 'sqs:SendMessage']
services granted but never used: ['dynamodb', 'ec2', 'iam']
suggested policy actions: ['s3:GetObject', 's3:PutObject', 'sqs:SendMessage']

Break-glass access

Keep a tightly controlled emergency role, protected by MFA, monitored, and tested, for when SSO is down.

Test yourself

What's the best way for a GitHub Actions workflow to deploy to AWS?

  1. OIDC federation to an IAM role
  2. An IAM user's access key in repository secrets
  3. The root user
  4. A shared admin password
Show answer

Answer: OIDC federation to an IAM role

Federation issues short-lived credentials per run, scoped by repository and branch.

Was this page helpful?