Cloud security basics · Lesson 2 of 5
Small permissions, smaller blast radius
Least privilege means granting only the access needed for a task. It applies to people, services, and automated processes.
Match the permission to the task
A reporting service only needs to read the sales dataset.
| Requested action | Decision | Reason |
|---|---|---|
| Read sales dataset | Allow | Required for this report |
| Delete sales dataset | Deny | Not part of the job |
| Read payroll dataset | Deny | Wrong resource |
| Manage user accounts | Deny | Unrelated administrative access |
Read the visualWould temporary administrator access be narrower than this policy?
No. A short lifetime does not make broad permissions narrow. Scope the access as well as its duration.
Separate identity from access
A signed-in user or service still needs an explicit authorization decision.
Scope permissions
Restrict allowed actions and resources instead of granting broad administrative access for convenience.
Review and remove
Permissions should change when responsibilities change. Deny access when no rule authorizes it.
Put it in context
A fictional reporting service needs to read one dataset. It does not need to delete datasets, manage users, or administer the entire environment.
Ask: which identity needs which action on which resource?
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.