---
title: "Give every role the least it needs · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles
updated: 2026-10-20
licence: "All rights reserved"
---

# Give every role the least it needs

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)
- Rule: Write every role's permissions in code, limited to named actions on named resources. Never grant every action on every resource, except to the break-glass role.
- How: Start from the actions the service calls and the resources it touches. Name them, such as `s3:GetObject` on one bucket. Use the cloud's access analysis, such as IAM Access Analyzer or Google's IAM recommender, to find permissions unused for 90 days and remove them. Grant roles to groups, never to single people.
- Check: A code scan, such as Checkov, finds no statement that allows `*` actions or a whole service, such as `s3:*`, on `*` resources. The break-glass role is the only exception. The access analyzer lists no unused permission older than 90 days.

Example:

```hcl
data "aws_iam_policy_document" "invoice_reader" {
  statement {
    actions   = ["s3:GetObject"]
    resources = ["arn:aws:s3:::example-shop-invoices/*"]
  }
}
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers infrastructure playbook: https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles`.

- Previous: [Keep no long-lived access keys](https://agentwranglers.se/playbook/infrastructure/identity-and-access/no-long-lived-keys)
- Next: [Separate the roles for plan and apply](https://agentwranglers.se/playbook/infrastructure/identity-and-access/separate-plan-and-apply-roles)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access)