Lesson 08 — Least Privilege & Permission Boundaries

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 02 – Identity & Access Management (IAM)

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Explain the Principle of Least Privilege.
Understand why excessive permissions are dangerous.
Design least privilege IAM policies.
Understand Permission Boundaries.
Prevent privilege escalation.
Apply enterprise security best practices.
Troubleshoot permission boundary issues.

📚 Lesson Information

Estimated Time: 4 Hours

Difficulty: Intermediate

Prerequisites: Lesson 07 – Policy Evaluation Logic

Hands-on Lab: Yes

Assignment: Yes

💼 Business Value

One of the biggest causes of cloud security incidents is excessive permissions.

Many organisations unknowingly grant employees:

AdministratorAccess
PowerUserAccess
Full access to AWS services

When an attacker compromises one of these accounts, they inherit all of those permissions.

The Principle of Least Privilege significantly reduces the impact of compromised credentials and accidental mistakes.

🏢 In the Company

CloudNova Technologies recently completed an internal security audit.

The audit discovered:

Developers have AdministratorAccess.
Interns can create IAM Users.
Contractors can terminate production EC2 instances.
Several applications have unnecessary permissions.

The CISO requests that every identity receives only the permissions required to perform its role.

Your task is to redesign CloudNova’s IAM environment using the Principle of Least Privilege.

🌍 What is the Principle of Least Privilege?

The Principle of Least Privilege (PoLP) states:

Every identity should receive only the minimum permissions required to perform its job—and nothing more.

This applies to:

IAM Users
IAM Groups
IAM Roles
AWS Services
Applications
Automation tools

🚫 Why Excessive Permissions Are Dangerous

Consider a developer who only needs to:

View EC2 instances
Start EC2 instances
Stop EC2 instances

Instead, they receive:

AdministratorAccess

Now they can:

Delete S3 buckets
Disable CloudTrail
Delete IAM Users
Modify Billing
Delete KMS Keys

One mistake—or one compromised account—could impact the entire AWS environment.

✅ Correct Approach

Instead of broad permissions:

AdministratorAccess

Grant only:

ec2:DescribeInstances

ec2:StartInstances

ec2:StopInstances

This limits risk while allowing the developer to perform their daily tasks.

🏢 CloudNova Permission Matrix

Team	Required Access
Cloud Administrators	Full AWS Administration
Cloud Engineers	Infrastructure Management
Developers	Development Resources Only
Security Team	Security Services & Monitoring
SOC Team	Read-Only Monitoring
Finance	Billing Dashboard
Auditors	Read-Only Across AWS

Each team receives permissions based on business requirements rather than convenience.

🔒 Permission Boundaries

A Permission Boundary defines the maximum permissions an IAM User or IAM Role can receive.

Think of it as a safety guardrail.

Even if someone attaches AdministratorAccess, the Permission Boundary prevents permissions beyond the defined limit.

🏗 How Permission Boundaries Work

IAM User

        │

Attached Policy

        │

Permission Boundary

        │

Effective Permissions

        │

AWS Resources

A user can never exceed the permissions allowed by the Permission Boundary.

🧠 Enterprise Example

CloudNova allows Team Leads to create IAM Users.

However, management does not want Team Leads creating administrators.

A Permission Boundary is created that prevents:

IAM Administrator permissions
Billing access
Security service modifications

Even if Team Leads attach AdministratorAccess, the boundary blocks those actions.

🔐 Benefits of Permission Boundaries

Prevent privilege escalation.
Enforce security standards.
Support delegated administration.
Reduce insider threats.
Simplify governance.
Improve compliance.

🚫 Common Mistakes

Avoid:

❌ Granting AdministratorAccess unnecessarily.

❌ Using wildcards (*) for all actions.

❌ Ignoring unused permissions.

❌ Allowing users to modify their own permissions.

❌ Forgetting to review permissions regularly.

✅ Enterprise Best Practices

Follow Least Privilege.
Review permissions quarterly.
Remove unused permissions.
Use Customer Managed Policies.
Apply Permission Boundaries for delegated administrators.
Monitor IAM changes using CloudTrail.
Document every permission granted.

🧪 Enterprise Mission 01 — Review Existing Permissions

Open the AWS Console.

Navigate to:

IAM

↓

Users

↓

Select User

↓

Permissions

Review:

Attached Policies
Group Membership
Effective Permissions

Questions:

Does the user have unnecessary access?
Which permissions could be removed?

🧪 Enterprise Mission 02 — Review AWS Managed Policies

Navigate to:

IAM

↓

Policies

Compare:

AdministratorAccess
PowerUserAccess
ReadOnlyAccess

Identify which policy best follows the Principle of Least Privilege.

🧪 Enterprise Mission 03 — Create a Least Privilege Policy

Create a file named:

DeveloperLeastPrivilege.json

Example:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Allow",
      "Action":[
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource":"*"
    }
  ]
}

Create the policy.

aws iam create-policy \
--policy-name DeveloperLeastPrivilege \
--policy-document file://DeveloperLeastPrivilege.json

🧪 Enterprise Mission 04 — Create a Permission Boundary

Create a policy named:

DeveloperBoundary

Example:

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Effect":"Deny",
      "Action":[
        "iam:*",
        "organizations:*",
        "account:*"
      ],
      "Resource":"*"
    }
  ]
}

Create it.

aws iam create-policy \
--policy-name DeveloperBoundary \
--policy-document file://DeveloperBoundary.json

🧪 Enterprise Mission 05 — Apply a Permission Boundary

Attach the Permission Boundary to an IAM User.

aws iam put-user-permissions-boundary \
--user-name alice.dev \
--permissions-boundary arn:aws:iam::ACCOUNT_ID:policy/DeveloperBoundary

Verify.

aws iam get-user \
--user-name alice.dev

🧪 Enterprise Mission 06 — Verify Effective Permissions

Review:

Attached Policies
Permission Boundary
Effective Permissions

Questions:

Which permissions are allowed?
Which permissions are blocked?
Can the user create IAM Users?

🧪 Enterprise Mission 07 — Review CloudTrail

Navigate to:

CloudTrail

↓

Event History

Search for:

CreateUser
AttachUserPolicy
PutUserPermissionsBoundary

Review how IAM changes are logged.

🧪 Enterprise Mission 08 — Enterprise Design Exercise

CloudNova plans to hire:

50 Developers
15 DevOps Engineers
10 Security Engineers
5 Interns

Design:

Required permissions.
Least Privilege policies.
Permission Boundaries.
Review process.

Document your recommendations.

🏢 Enterprise Scenario

CloudNova introduces a self-service onboarding system.

Department Managers can create IAM Users for their teams.

The CISO has one condition:

“Managers must never be able to grant AdministratorAccess.”

Design a secure solution using Permission Boundaries.

📊 Knowledge Check

What is the Principle of Least Privilege?
Why is AdministratorAccess dangerous?
What is a Permission Boundary?
Can a Permission Boundary grant additional permissions?
What is privilege escalation?
Why should permissions be reviewed regularly?
Which CLI command applies a Permission Boundary?
Why are Customer Managed Policies preferred?
How do Permission Boundaries improve security?
Why are they useful in enterprise environments?

📝 Assignment

Prepare an Enterprise Least Privilege Implementation Guide.

Include:

Principle of Least Privilege
Permission Boundaries
Enterprise Permission Matrix
Developer Policy Example
Permission Boundary Example
AWS CLI Commands Used
Screenshots
Lessons Learned

Length: 5–6 Pages

📋 Lesson Completion Checklist

Task	Status
Reviewed Existing Permissions	☐
Compared AWS Managed Policies	☐
Created Least Privilege Policy	☐
Created Permission Boundary	☐
Applied Permission Boundary	☐
Reviewed Effective Permissions	☐
Reviewed CloudTrail Events	☐
Completed Enterprise Design	☐
Completed Assignment	☐

💡 Key Takeaways

After completing this lesson, you should understand:

Least Privilege is one of the most important principles in cloud security.
Identities should receive only the permissions required for their role.
Permission Boundaries define the maximum permissions an identity can receive.
Permission Boundaries help prevent privilege escalation and support delegated administration.
Applying Least Privilege reduces security risks while maintaining business productivity.

📚 Further Reading

AWS IAM Permission Boundaries Documentation
AWS IAM Best Practices
AWS Security Pillar – Well-Architected Framework
AWS IAM Policy Reference
AWS CloudTrail User Guide

🚀 Next Lesson

➡️ Lesson 09 — Multi-Factor Authentication (MFA)