c3.5 Review IAM for least privilege
Roles are often created with more permissions than needed, especially under delivery pressure. Periodically right-size IAM policies toward least privilege using IAM Access Analyzer to find unused access and generate tight policies from actual activity.
Implementation guidance
Right-size permissions
Under delivery pressure, roles tend to accumulate permissions they never use, which violates least privilege. Periodically review roles and remove unnecessary permissions. Pay particular attention to wildcards — "Action": "" or "Resource": "" — which usually signal a policy that was never tightened. Follow the IAM best practices.
Use IAM Access Analyzer
IAM Access Analyzer does much of this work:
- Unused access — configure an organization analyzer to find unused roles, permissions, and credentials to remove.
- Policy generation — generate a least-privilege policy from CloudTrail activity. A practical workflow: run with broad permissions in a dev account, exercise the application, generate the tight policy, then test it through to production.
Generate a policy with the CLI
Start a policy-generation job from a role's CloudTrail activity, then retrieve the tight, least-privilege policy it produces:
aws accessanalyzer start-policy-generation \
--policy-generation-details '{"principalArn":"arn:aws:iam::111122223333:role/my-role"}' \
--cloud-trail-details file://cloudtrail-details.json
aws accessanalyzer get-generated-policy --job-id <job-id>Partner and open-source tooling
Cloud Infrastructure Entitlement Management (CIEM) tools on the AWS Marketplace can help at scale. For open source, Cloudsplaining visualizes policies and highlights the risk of over-permissive ones.
How to validate
- Do you periodically review IAM roles and remove unused permissions?
- Have you addressed wildcard (*) actions and resources in policies?
- Are you using IAM Access Analyzer for unused-access findings and policy generation?
Threats addressed
- Over-permissive roles increase the blast radius of a compromised identity: the more an identity can do, the more an attacker who steals it can do.
AWS services
IAM Access Analyzer AWS IAM