Principle of Least Privilege

Scoped IAM policy for an application role in TypeScript (CDK)

import * as iam from 'aws-cdk-lib/aws-iam';
import * as s3 from 'aws-cdk-lib/aws-s3';
import { Stack } from 'aws-cdk-lib';

export function createAppRole(stack: Stack, uploadBucket: s3.Bucket): iam.Role {
  const role = new iam.Role(stack, 'AppRole', {
    assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
    description: 'Role for the web application; upload-only access to S3',
  });

  // Only PutObject to a specific bucket prefix; no GetObject, no DeleteObject
  role.addToPolicy(new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['s3:PutObject'],
    resources: [uploadBucket.arnForObjects('uploads/*')],
  }));

  // Read from Secrets Manager for specific secrets only, not *
  role.addToPolicy(new iam.PolicyStatement({
    effect: iam.Effect.ALLOW,
    actions: ['secretsmanager:GetSecretValue'],
    resources: [
      'arn:aws:secretsmanager:us-east-1:123456789:secret:prod/app/db-*',
      'arn:aws:secretsmanager:us-east-1:123456789:secret:prod/app/stripe-*',
    ],
  }));

  return role;
}

Scoping S3 access to uploads/* means a compromised application cannot read or delete files outside that prefix. Scoping Secrets Manager to specific secret ARN patterns prevents the application from reading secrets intended for other services.

Database user with minimal privileges in Ruby migration

# db/migrate/20250601_create_app_database_user.rb
# Run manually as a superuser; not part of schema migrations
class CreateAppDatabaseUser < ActiveRecord::Migration[7.1]
  def up
    # Application user: cannot create tables, drop tables, or access other schemas
    execute "CREATE USER app_user WITH PASSWORD 'use-secrets-manager-not-this';"
    execute "GRANT CONNECT ON DATABASE app_production TO app_user;"
    execute "GRANT USAGE ON SCHEMA public TO app_user;"

    # Grant DML only on specific tables, not TRUNCATE or DDL
    execute "GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO app_user;"
    execute "GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO app_user;"

    # Separate read-only replica user for reporting
    execute "CREATE USER reporting_user WITH PASSWORD 'use-secrets-manager';"
    execute "GRANT CONNECT ON DATABASE app_production TO reporting_user;"
    execute "GRANT USAGE ON SCHEMA public TO reporting_user;"
    execute "GRANT SELECT ON ALL TABLES IN SCHEMA public TO reporting_user;"
  end
end

The application user cannot DROP TABLE, TRUNCATE, or CREATE TABLE. A SQL injection vulnerability through the application user cannot destroy schema or exfiltrate data from other schemas. The reporting user is read-only; connecting it to the replica prevents reporting queries from impacting primary write performance.