Least privilege for machines

Something fails and time is short. Someone gives the app admin, just to make it work. Months later the app is breached, and the attacker gets admin too. Your goal: give a machine only the power its job needs.

The admin shortcut that becomes the breach

Think of a night cleaner who only needs the store room. The office hands over the master key "to avoid trouble". A thief steals the key ring, and every room is open. Bot A is that cleaner.

Machines do not complain about too much access, so over-granting stays hidden. Bot A needs to read one queue and write one bucket. But it was created with admin:*, because that stopped the errors fastest.

A workload's permissions are the ceiling on what an attacker can do after taking it over. Least privilege means the ceiling matches the job exactly. A wildcard policy such as *:* allows all actions on all resources. An admin role for a service that reads one table is just as bad.

Grant the verb and the noun, nothing more

A good machine permission is specific in two ways. It names the action (the verb: read, not *). It names the resource (the noun: one invoice folder, not every account). See RBAC, ABAC & ReBAC. There are two ways to get there:

Watch long enough to see rare jobs. A report that runs once a quarter will not show up in a two-week log.

Separation of duties, even for robots

People get separation of duties. The person who asks for a payment cannot also approve it. Machines need it too. The workload that writes the audit log must not be able to delete it. The deploy job must not read customer data. Split strong abilities across different identities. Then no single stolen credential can do everything.

Guardrails: a limit that a bad policy cannot pass

People make mistakes, so add a backstop. A permission boundary sets the most that any identity in a scope may ever do. It is also called a guardrail. The real permission is the overlap of what is granted and what the guardrail allows.

Say someone adds admin:* by mistake. The guardrail can still forbid delete-all and create-admin across the whole organization. Those actions never go through.

Kill standing privilege with just-in-time elevation

Standing privilege is power that sits there day and night, waiting to be stolen. JIT elevation gives a risky ability only for the minutes a task needs it, then removes it. It is the machine version of break-glass and privileged access: request, approve, use, expire.