What it is
Least privilege means each user, role, or service gets only the permissions required to do its job. Nothing more. Not "admin until Friday." Not "admin because the portal was confusing."
In AWS IAM that usually means scoped policies instead of broad managed policies like AdministratorAccess. In Azure Entra and RBAC it is the same idea with different labels: give the role that matches the work, not Owner because it was easier.
The practical difference is blast radius. A leaked credential with least privilege might read one bucket. The same leak with admin rights can alter production or open a surprise invoice while you are still in the standup.
Why it matters in the meeting
When someone says "we gave them admin so they could finish faster," the meeting has already traded speed today for risk every day after. Bart will ask for how long, and who reviews it when the project ends. The honest answer is often "we forgot."
Least privilege is slower to set up once. Admin for everyone is slower forever, in the form of incidents, audits, and JJ asking why a contractor can still see the billing export.
Real world
Most cloud incidents do not start with a genius attacker. They start with a valid credential that had far more power than the job required. Least privilege does not stop every attack. It limits how far one mistake can travel.
Temporary elevation exists for a reason: Privileged Identity Management on Azure, short-lived roles on AWS. Borrow the power for an hour. Do not park it in a mailbox named ops@.
If a role can do everything, a stolen key can do everything. Scope the job, then grant only that. Admin for convenience is how convenience becomes a press story.
What to ask
- Which roles still carry AdministratorAccess or Owner, and why?
- Can this service do its job with a narrower policy?
- How long do temporary credentials live before they expire?
- Who reviews permission changes after a project ends, and when did that last happen?
You just knew a little more Jack than you did five minutes ago.
All concepts