Overview — IAM Least-Privilege Policy Library

A starter library of tight, copy-pasteable IAM policies for the roles teams

actually create — instead of the *:* policy someone pasted at 2am that never got

fixed. Covers AWS (JSON policies) with GCP and Azure equivalents, plus a review

checklist for tightening what you already have.

Why this exists

Most breaches that start with a cloud role start with an over-broad one:

s3:* on *, AdministratorAccess handed to a CI runner, a Lambda that can read

every secret. Writing least-privilege policies from scratch is tedious, so people

don't. This library gives you a correct starting point per role that you narrow to

your resource ARNs.

What's inside

• policies/aws/ — least-privilege JSON policies for common roles:
• ci-deployer.json — push images, update one ECS service, read specific SSM params.
• s3-app-readwrite.json — read/write ONE bucket + prefix, nothing else.
• lambda-execution.json — logs + one queue + one table, scoped by ARN.
• readonly-auditor.json — describe/list/get across services, no data reads.
• secrets-consumer.json — GetSecretValue on a tagged subset only.
• policies/gcp/custom-roles.yaml — equivalent GCP custom roles.
• policies/azure/custom-roles.json — equivalent Azure custom role definitions.
• REVIEW-CHECKLIST.md — how to audit and tighten an existing policy.
• PRINCIPLES.md — the rules (deny by default, scope by ARN, no wildcards on

actions AND resources, condition keys, permission boundaries).

How to use

1. Pick the policy closest to the role you're creating.

2. Replace every REPLACE_* placeholder with your real account id / ARNs / tags.

3. Run it through your provider's policy simulator before attaching.

4. Attach with a permission boundary so the role can never escalate itself.

Requirements

None. Provider CLIs (aws/gcloud/az) if you want to apply the policies.