A developer needs to read objects under one S3 prefix.
No resource-changing permission is required.
Which action follows the principle of least privilege?
Least privilege grants only the actions, resources, and conditions required for the task.
Detailed explanation
This permits an unnecessary action across resources outside the task.
This permits an unnecessary action across resources outside the task.
This grants far more access than reading one S3 prefix requires.
This grants far more access than reading one S3 prefix requires.
The action and resource scope are limited to the developer's stated requirement.
The action and resource scope are limited to the developer's stated requirement.
Root credentials cannot express the required narrow scope and create severe exposure.
Root credentials cannot express the required narrow scope and create severe exposure.
Check official documentation
Compare the following points with the official documentation.
IAM User GuideのPolicies and permissionsとGrant least privilegeの説明を確認する。
What to confirm
指定したS3プレフィックスの読み取りだけが許可され、不要な書き込みや他リソース操作は許可されない。
Key points
- Least privilege
- IAM policy
- Resource scope
Notes
- Environment: AWS公式IAMドキュメントのポリシー確認
- Confirm current IAM capabilities and recommended practices in the official AWS documentation.
Foundation review
Permission boundary
Least privilege narrows actions, resources, and sometimes conditions.
Progressive access
Start narrowly and expand only when evidence shows that additional access is required.