Start with the workload
Permissions should follow the workload's actual actions. Avoid beginning with broad administrator access and trying to remove permissions later.
1. Prefer roles
Use role-based access for workloads and temporary administrative access where practical. Keep long-lived credentials out of application code and automation wherever possible.
2. Scope resources
Where the service supports it, constrain actions to specific resources rather than using wildcard resources. Conditions can add useful context to an authorization decision.
3. Review trust policies
Permissions determine what an identity can do; trust policies determine who or what can assume a role. Review both sides of the relationship.
4. Observe and iterate
Need → Action → Resource → Condition → Evidence → ReviewUse access activity and operational evidence to identify permissions that are no longer required. Least privilege is a lifecycle, not a one-time configuration.
Security rule
Grant the minimum access required for a defined task, then continuously validate that assumption.