Give every role the least it needs

How to do it

Start from the actions the service calls and the resources it touches. Name them, such as s3:GetObject on one bucket. Use the cloud's access analysis, such as IAM Access Analyzer or Google's IAM recommender, to find permissions unused for 90 days and remove them. Grant roles to groups, never to single people.

Example

data "aws_iam_policy_document" "invoice_reader" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::example-shop-invoices/*"]
  }
}

How to check

A code scan, such as Checkov, finds no statement that allows * actions or a whole service, such as s3:*, on * resources. The break-glass role is the only exception. The access analyzer lists no unused permission older than 90 days.