CLF-C02 Practice Question 73: Least Privilege
AWS Certified Cloud Practitioner (CLF-C02) · Test 8 · question 3 of 10
A new data analyst needs to read report files stored in one specific Amazon S3 bucket, and nothing else. An administrator is deciding how to grant this access. Which approach follows AWS security best practices?
Show answer and explanation
Answer:
AWS recommends applying least-privilege permissions: grant only the permissions required to perform a task, by defining the specific actions allowed on specific resources. A customer managed policy that allows only reading from this one bucket gives the analyst exactly what the job requires. IAM Access Analyzer can also help refine policies toward least privilege based on actual access activity.
Option B uses an AWS managed policy. AWS suggests these as a *starting point*, but warns they might not grant least privilege for a specific use case because they are written for all customers. Full access would let the analyst write to and delete from every bucket in the account. Option C grants far more access than the task needs, and "temporary" broad access tends to become permanent. Option D breaks individual accountability: every person should have their own identity, so activity can be traced and access removed when they leave.
Reference: Security best practices in IAM