Cloud › Module 3 › Lesson 2
Least Privilege
Least privilege literacy means minimum actions and resources for each job — draft trim plans on YOUR $CLOUD_LAB policies before production-style changes.
Visual · t31_least_privilege
Least privilege literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
AdministratorAccess is a red flag, not a default — literacy teaches how to read wildcards and scope down on sandboxes you own.
Least privilege applies actions (s3:GetObject not s3:*), resources (specific bucket ARN not *), and conditions (MFA present, source IP). Start from job function: backup role needs snapshot APIs, not iam:*. Review policy summaries, remove unused grants, prefer roles over users, enforce permission boundaries on lab roles where practiced. Cyberlium drafts least-privilege trim notes on YOUR $CLOUD_LAB — paper diff only until you confirm sandbox scope. Next: Keys and Roles.
1. Least privilege levers (named)
Action scope: replace service wildcards with required API list. Resource scope: ARN-specific instead of *. Condition keys: aws:MultiFactorAuthPresent, aws:SourceIp for lab fictional admin role.
On $CLOUD_LAB, pick one overly broad lab policy statement and write trimmed action and resource list on paper.
Command guide
Try these commands — Least privilege levers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IAM least privilege — https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege AWS Access Analyzer — https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html OWASP cloud — https://owasp.org/www-project-cloud-security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/aws/iam-least-privilege-checklist.md" <<'EOF'
# IAM Least Privilege Checklist — YOUR ACCOUNT
- [ ] No long-lived access keys for humans (prefer SSO + role)
- [ ] Workload roles instead of embedded keys
- [ ] Policies scoped to specific ARNs, not * on *
- [ ] Remove unused users/roles (Access Analyzer review)
- [ ] MFA on root and privileged users
- [ ] Permission boundaries for delegated admin
Review in YOUR account only — never export stranger IAM data
EOFCommand — copy this
grep '\[ \]' "$CLOUD_LAB/aws/iam-least-privilege-checklist.md" curl -sS https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: IAM least privilege (https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege); AWS Access Analyzer (https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html); OWASP cloud (https://owasp.org/www-project-cloud-security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why least privilege reduces blast radius
Stolen key with s3:* and iam:* enables data exfil and persistence — narrow grants limit damage. Auditors and CSPM score wildcard policies; remediation tickets cite least privilege.
Students practice trim proposals on sandbox — change control on employer prod is ticket + peer review.
3. Literacy ≠ prod surgery without ticket
Forbidden: silently trimming employer IAM in production without approval. Allowed: least privilege plan — before/after statement summary for $CLOUD_LAB fictional role.
Ship: least privilege trim plan for YOUR lab role. Next: Keys and Roles.
4. What you ship: least privilege trim plan for $CLOUD_LAB
Before/after policy summary for one lab role. $CLOUD_LAB named. NO prod without ticket. chmod 600.
5. What you record before the next lesson
Date. Least privilege plan. $CLOUD_LAB named. File t31-m03-l02-least-privilege.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Grant AdministratorAccess for convenience. Trim employer prod IAM without ticket.
Right
Write least privilege trim plan for YOUR $CLOUD_LAB role. Next: Keys and Roles.
Mission: draft least privilege trim on YOUR lab role
1) Copy one broad lab policy summary. 2) List minimum actions needed for fictional job. 3) Write trimmed resource ARNs. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Wildcards are debt — trim on sandbox before habits reach production.
Knowledge Check
APPLY: Least privilege means:
Multiple choice
Knowledge Check
APPLY: True or False: Resource ARNs can scope policies tighter than action wildcards alone.
True or False
Knowledge Check
APPLY: Least privilege literacy on Cyberlium means:
Multiple choice