Skip to content
SCA

Cloud Security · Practice

Cloud IAM & Least Privilege

Identity and access management is the backbone of cloud security — grant only what's needed.

Overview

Identity is the new perimeter. In the cloud, who can do what to which resource is decided by IAM, and least privilege — granting only the permissions a task genuinely needs — is the single highest- leverage control.

Core practices

  • Prefer roles over long-lived keys. Use short-lived, assumed credentials; avoid static access keys committed to code.
  • Scope to specific actions and resources. Grant s3:GetObject on one bucket ARN, not *.
  • Add guardrails. Permission boundaries and organization policies (SCPs) cap what any identity can do.
  • Review continually. Tools like access analyzers surface unused or over-broad permissions.

How it maps

ProviderPrimitive
AWSIAM policies, roles, permission boundaries, SCPs
AzureAzure RBAC + Entra ID role assignments
GCPCloud IAM roles and conditions
KubernetesRBAC Roles / RoleBindings

This is the same Access Control covered across every framework — see Control Explorer.

Practice it

Do the least-privilege IAM lab.

References

See the primary source below.

Primary sources