Least Privilege and Data Perimeters

What it is

Least privilege means each identity gets only the permissions it needs, for only as long as it needs them. At professional level, the question is how to keep that true across hundreds of accounts.

A data perimeter is the organization-wide version of the same idea. Only trusted identities should reach your resources, only from expected networks, and your identities should reach only trusted resources.

How it works

Policy types and how they combine

An explicit deny anywhere wins. Otherwise a request is allowed only if every applicable guardrail permits it and at least one policy grants it.

Cross-account access and temporary credentials

The standard pattern is a role in the target account with a trust policy naming the source account or role. The caller needs sts:AssumeRole in its own account, and the role's trust policy must allow it, so both sides agree.

Within one account, a resource policy alone can grant access. Across accounts, the caller's identity policy and the resource policy must both allow the action.

When a third party (a SaaS vendor, for example) assumes a role in your account, add an external ID condition (sts:ExternalId) to the trust policy. It prevents the confused deputy problem, where another customer of the vendor tricks it into using your role.

Delegating safely with boundaries and session policies

A permissions boundary lets a central team delegate role creation. Developers may create roles only if they attach the approved boundary, so no new role can exceed it, even with AdministratorAccess attached.

A session policy is passed in the AssumeRole call. The session gets the intersection of the role's permissions and the session policy, which suits a broker that issues narrower credentials per tenant.

Attribute-based access control (ABAC)

ABAC grants access when tags match, for example aws:PrincipalTag/project equals aws:ResourceTag/project. One policy then covers every project, and new projects need tags, not new policies.

Tags can come from the IdP as session tags, or from IAM Identity Center attributes for access control. Protect the tags themselves by denying changes to the tag keys used for authorization.

Data perimeters with condition keys

A VPC endpoint policy restricts what can be done through that endpoint. Using aws:ResourceOrgID in it stops someone inside your VPC from copying data to a bucket in a personal account.

Validating external access with IAM Access Analyzer

IAM Access Analyzer uses logic-based reasoning on policies. You create an analyzer with a zone of trust, the account or the whole organization.

• External access findings show resources (such as S3 buckets, IAM roles and KMS keys) shared outside the zone of trust.
• Internal access findings show which principals inside the organization can reach selected critical resources.
• Unused access findings show unused roles, keys, passwords and unused permissions on active roles.
• Policy validation and custom policy checks catch errors or new access before deployment.
• Policy generation builds a least-privilege policy from CloudTrail activity.

External access analyzers are Regional, so you create one in each Region where you use supported resources.

Zero trust application access with AWS Verified Access

AWS Verified Access gives users access to internal applications without a VPN. It evaluates every request against a Cedar access policy using trust data from an identity provider (such as IAM Identity Center or an OIDC IdP) and optional device trust providers.

It supports HTTP applications and also TCP resources such as databases, which need the Verified Access Connectivity Client on the user's device.

How the exam asks about this

• "A SaaS monitoring vendor needs read access to 50 customer accounts, and the company is worried about confused deputy." -> Cross-account role per account with an sts:ExternalId condition.
• "Developers must create roles for their Lambda functions without being able to escalate privileges." -> Permissions boundary required by policy on every role they create.
• "Find every resource shared outside the organization and block new public shares in the pipeline." -> IAM Access Analyzer with the organization as zone of trust, plus custom policy checks in CI/CD.