What is the principle of least privilege, and how do you implement it in AWS IAM?

The principle of least privilege means granting users, applications, and services only the minimum permissions necessary to perform their required tasks. In AWS IAM, this is implemented through:

• Granular permissions: Use specific actions rather than wildcards
• Resource-level permissions: Restrict access to specific resources using ARNs
• Condition-based policies: Add conditions for time, IP address, MFA requirements
• Regular access reviews: Periodically audit and remove unused permissions

Example IAM Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/logs/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}