AWS, Azure & GCP · Cloud across providers
How do you apply least privilege in the cloud?
Short answer
Start with no permissions, grant the smallest action set on the narrowest resource for the shortest time, and refine using logs and access analysers. Prefer roles and short-lived credentials over long-lived keys.
Least privilege is a process, not a single policy. You begin from deny, grant what the workload demonstrably needs, observe actual usage, and then remove what is unused. The goal is to limit what an attacker or a bug can reach.
A practical sequence
- Identify the exact actions and resources from API logs or documentation
- Grant through a role scoped to one environment and one service
- Add conditions such as source VPC endpoint, MFA or resource tags
- Review unused permissions with access analysers or last-accessed data
- Remove wildcards and unused grants on a schedule
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["dynamodb:GetItem", "dynamodb:PutItem"],
"Resource": "arn:aws:dynamodb:ap-south-1:123456789012:table/orders",
"Condition": {
"StringEquals": { "aws:SourceVpce": "vpce-0123456789abcdef0" }
}
}
]
}Break-glass access still has a place. Give it a named role, require approval or MFA, log every use, and review it afterwards. That is safer than leaving permanent admin access because emergencies are rare.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1How do you discover which permissions a service actually needs?
- 2What is a permission boundary?
- 3How do you handle emergency access without permanent admin?
- 4Why are long-lived access keys a least-privilege problem?
Say it in the interview
I start from deny and grant only the actions and resources a workload needs, ideally through a role with short-lived credentials. I use conditions like source VPC endpoint or MFA, then review last-accessed data and remove unused permissions. For emergencies I keep a logged, MFA-protected break-glass role rather than permanent admin.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.