Least Privilege

Least privilege literacy means minimum actions and resources for each job — draft trim plans on YOUR $CLOUD_LAB policies before production-style changes.

Least Privilege• Audio Walkthrough

00:00/03:36

Visual · t31_least_privilege

Least privilege literacy. $CLOUD_LAB only. Original Cyberlium.

AdministratorAccess is a red flag, not a default — literacy teaches how to read wildcards and scope down on sandboxes you own.

Least privilege applies actions (s3:GetObject not s3:*), resources (specific bucket ARN not *), and conditions (MFA present, source IP). Start from job function: backup role needs snapshot APIs, not iam:*. Review policy summaries, remove unused grants, prefer roles over users, enforce permission boundaries on lab roles where practiced. Cyberlium drafts least-privilege trim notes on YOUR $CLOUD_LAB — paper diff only until you confirm sandbox scope. Next: Keys and Roles.

1. Least privilege levers (named)

Action scope: replace service wildcards with required API list. Resource scope: ARN-specific instead of *. Condition keys: aws:MultiFactorAuthPresent, aws:SourceIp for lab fictional admin role.

On $CLOUD_LAB, pick one overly broad lab policy statement and write trimmed action and resource list on paper.

Command guide

Try these commands — Least privilege levers (named)

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, curl. Reference sites: IAM least privilege (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege); AWS Access Analyzer (https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html); OWASP cloud (https://owasp.org/www-project-cloud-security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why least privilege reduces blast radius

Stolen key with s3:* and iam:* enables data exfil and persistence — narrow grants limit damage. Auditors and CSPM score wildcard policies; remediation tickets cite least privilege.

Students practice trim proposals on sandbox — change control on employer prod is ticket + peer review.

3. Literacy ≠ prod surgery without ticket

Forbidden: silently trimming employer IAM in production without approval. Allowed: least privilege plan — before/after statement summary for $CLOUD_LAB fictional role.

Ship: least privilege trim plan for YOUR lab role. Next: Keys and Roles.

4. What you ship: least privilege trim plan for $CLOUD_LAB

Before/after policy summary for one lab role. $CLOUD_LAB named. NO prod without ticket. chmod 600.

5. What you record before the next lesson

Date. Least privilege plan. $CLOUD_LAB named. File t31-m03-l02-least-privilege.txt chmod 600.

6. Wrong vs right: stranger tenants vs YOUR cloud accounts

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Grant AdministratorAccess for convenience. Trim employer prod IAM without ticket.
Right: Write least privilege trim plan for YOUR $CLOUD_LAB role. Next: Keys and Roles.

Hands-on Exercise