阅读中文版本

Least-Privilege Review Workflow

Review IAM policies and roles to remove wildcard permissions and confirm each principal has only what it uses.

Overview

Reduce excessive permissions by reviewing policies against actual usage.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• IAM configuration
• Access usage logs
• Policy analysis tooling

Procedure

1. Inventory principals and policies

List identities, roles, and the policies attached to each.

Expected state: A complete permission inventory exists.

2. Compare against usage

Identify granted permissions that are never used.

Expected state: Unused permissions are visible.

3. Remove wildcards and excess

Replace wildcards and unused actions with the minimum needed.

Expected state: Policies grant only required actions.

4. Re-verify after change

Confirm services still work and no legitimate access broke.

Expected state: Tightened policies do not break operations.

# find wildcard actions in a policy document
jq '.Statement[] | select(.Action == "*" or (.Action | type=="array" and index("*")))' policy.json

Verification

Confirm tightened policies still allow normal operation and that wildcard grants are gone.

Decision points

Remove unused permissions immediately or warn first?

• Warn then remove
• Remove immediately

Recommendation: Warn first in lower environments, then remove once stable.

Deny or allow by default?

• Deny by default
• Allow by default

Recommendation: Deny by default; explicit allows are auditable.

Common failures

• Wildcards grant far more than intended.
• Removing used permissions breaks services.
• No usage data means guessing.