Cloud Engineer · Step 3 of 8 · 8 min
Identity and access: least privilege
Lock down the most powerful account and give people and apps only the access they need.
Identity is the new perimeter
In the cloud, anyone with the right credentials can reach your resources from anywhere. That makes identity and access management, IAM, the most important security control you have. AWS IAM, Microsoft Entra ID with Azure role-based access control, and Google Cloud IAM all solve the same problem: who can do what to which resource.
Protect the top account first
When you create a cloud account, the first login has full power over everything, including billing. On AWS this is the root user. Turn on multi-factor authentication for it straight away, use a strong unique password, and stop using it for daily work.
Create a separate everyday identity for yourself with only the rights you need. Most providers now push you towards single sign-on and short-lived credentials, which is the right direction.
Least privilege
Least privilege means each person or app gets the smallest set of permissions that lets it do its job, and nothing more. A backup job needs to write to one bucket, not delete every database.
Grant access to roles and groups, not individuals one by one. Prefer roles with temporary credentials over long-lived access keys. Review access regularly, and remove it when people change jobs.
Keys are passwords
Access keys and service account keys work like passwords that never expire. Never put them in code, Git, chat or screenshots. Bots scan public repositories for leaked cloud keys within minutes, and a leaked key can run up a large bill mining cryptocurrency.
Try it
Write and review a least-privilege policy
- 1.Pick a task: an app that uploads photos to one storage bucket.
- 2.Ask a chatbot the prompt below for a policy on the provider you prefer.
- 3.Read every permission. Ask yourself whether the app could still work if you removed it.
- 4.Look for any wildcard, such as * on actions or resources, and narrow it.
Write a least-privilege IAM policy for an app that only uploads and reads images in one storage bucket called [name], on [AWS, Azure or Google Cloud]. Explain each permission, and point out anything that is broader than needed.