Least privilege service identities
Ask for one allowed operation and one denied operation
Policy review needs runtime evidence and a clear workload purpose. Syntax validation cannot establish that the intended boundary works.
In this article
Read the operation inventory
Identify normal, scheduled and recovery actions with their target resources. Ask why each permission is necessary and which application path uses it.
Check that infrequent work is represented. A generated policy based on recent activity may omit a restoration or month-end operation.
Review exceptions where the provider does not support narrower resource scope. The justification should be specific to the action and environment.
Inspect trust and effective authority
Determine who can obtain the identity and whether the trust conditions identify the intended workload. Then inspect other policies that affect access under the provider's evaluation rules.
Look for privilege-changing capabilities such as altering deployment configuration or assuming another role. These can matter more than an ordinary read permission.
Confirm that runtime and deployment identities are separated where their responsibilities differ, and that long-lived credentials are not used unnecessarily.
Verify the actual principal
Run the normal workflow under the deployed identity and capture its non-secret principal reference. Ensure a developer credential or old fallback is not making the test pass.
Attempt a specific prohibited action against a safe test resource and confirm an authorisation denial. A missing resource or network error does not establish the policy boundary.
Exercise credential renewal and a recovery path. Startup success alone may miss the permissions needed later in the job.
Review change and retirement procedures
Check how a policy update is versioned, verified and rolled back. Temporary emergency access should have a named owner and removal condition.
Confirm that the identity appears in the workload ownership inventory and will be reviewed when the service is retired. Unused trust relationships should not survive indefinitely.
Approve the design with evidence that the required job works and unrelated authority is denied. A short policy file or a familiar managed-policy name is not sufficient evidence of either property.
Primary sources
AWS: policy generationAWS: policy evaluation logicReferences checked 11 September 2026.