AWS IAM Best Practices: Least Privilege in the Real World

AWS Identity and Access Management (IAM) is the foundation of AWS security. Every action in AWS — creating an EC2 instance, reading an S3 object, invoking a Lambda function — is authorised by IAM. A misconfigured IAM policy is the most common root cause of AWS security incidents: an IAM user with administrator access whose credentials are leaked, an EC2 instance role with s3:* on all buckets, a Lambda function that can read every secret in Secrets Manager.

Least privilege — granting only the permissions required to perform a specific task, on specific resources, under specific conditions — is easy to define and hard to implement consistently across a growing AWS environment. This guide covers the practical patterns and AWS-native tooling that make least privilege operationally sustainable rather than aspirational.

THE MOST IMPORTANT IAM RULE

Never use the root account for day-to-day operations, and never create root access keys. The root account has unrestricted access to everything in the AWS account — it cannot be restricted by SCPs or IAM policies. If root credentials are compromised, the attacker owns your entire AWS account. Create an IAM Identity Center (SSO) admin user for all regular operations. Delete root access keys immediately if any exist: AWS Console > Security Credentials > Access…