Cloud Engineer interview question
How do you apply IAM least privilege?
Grant identities only the actions and resources required for a bounded task, prefer short-lived workload roles, constrain conditions, separate administration, analyze real usage, review exceptions, and continuously remove unused permissions.
Direct answer
What a strong answer covers
How it works
Least privilege is a practice, not a setting. Each workload and person gets an identity scoped to a bounded task, with policies that list the specific actions and resources rather than wildcards, and conditions such as source VPC or tag that narrow further. Workloads assume short-lived roles instead of holding static keys. Administration is separated from daily use, and privileged roles require step-up authentication. The cloud’s access analysers show which permissions were actually used over 90 days, and the unused ones are removed; exceptions have an expiry and an owner, and the whole set is recertified on a schedule.
Example
An order service’s role allows s3:GetObject on one bucket prefix, dynamodb:PutItem and Query on one table, and sqs:SendMessage on one queue, with a condition restricting the S3 access to requests from its VPC endpoint. IAM Access Analyzer’s last-accessed data showed the role never used a legacy sns:Publish permission, which was removed. Human access to production goes through a break-glass role that requires MFA and logs a ticket ID.
Common mistakes
- Attaching AdministratorAccess to a service because scoping it was inconvenient.
- Using long-lived access keys in CI or on servers.
- Granting permissions once and never reviewing what is still used.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.