Least privilege grants the minimum permissions needed for the job—users, service accounts, and cloud IAM roles.
Examples
- App DB user: SELECT/INSERT on app tables only—not DROP DATABASE
- CI role: deploy to staging—not production admin
- Developers: no production customer PII by default
Just-in-time
Elevated access for limited time with approval—reduces standing admin rights.
Link AWS
Mirror habits from AWS IAM least-privilege lessons.
Important interview questions and answers
- Q: Standing admin risk?
A: Long-lived powerful credentials increase blast radius. - Q: Service account?
A: Non-human identity for apps—scope narrowly.
Self-check
- Define least privilege.
- Give one least-privilege example for a DB user.
Tip: Mirror AWS IAM lesson—no AdministratorAccess for daily dev accounts.
Interview prep
- Least privilege?
Minimum permissions required for the task.