Cloud IAM & least privilege

Scope a backup reader permission

Lesson 6 of 20 · 12 min · Module 2: Review change and scope access

A role should receive the actions and resources its responsibility actually requires.

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Name the required operation
Scope the resource boundary

The idea

An access policy connects an effect, a permitted action, and a resource boundary. Review those parts together instead of treating any single word as proof of safe access.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::example-bucket"
    }
  ]
}

01Name the required operation

Reading a backup object does not imply permission to delete the bucket or administer the account. Start with the concrete job responsibility.

02Scope the resource boundary

An object ARN ending in /* refers to objects in this example bucket. It is different from granting access to every resource with a bare wildcard.

03Understand the document review boundary

The lab checks an example IAM policy document. It does not evaluate every real cloud policy layer or attach a role to an account.

Your turn

Write an IAM JSON policy with Version 2012-10-17 and one Allow statement. Permit only s3:GetObject on arn:aws:s3:::codetemper-backups/*.

What the checks look for

Uses exactly one Allow statement
Limits the action to GetObject
Scopes the backup object resources

Try it in the editor →

Take this with you

Derive permissions from a specific responsibility and resource boundary.

Go a little further

Explain the additional action and bucket-level resource needed to list objects.