SeniorSenior (6–10 yrs)AWSAmazonCapital OneNetflix
AWS IAM least privilege
How do you design least-privilege IAM for an ECS/EKS workload writing to one S3 prefix?
Answers use simple, clear English.
Quick interview answer
Attach a task/IRSA role (not user access keys) with a policy allowing s3:PutObject/GetObject only on arn:aws:s3:::bucket/prefix/* plus ListBucket with prefix condition. Deny broad *. Use SCPs for org guardrails.
Detailed answer
Attach a task/IRSA role (not user access keys) with a policy allowing s3:PutObject/GetObject only on arn:aws:s3:::bucket/prefix/* plus ListBucket with prefix condition. Deny broad *. Use SCPs for org guardrails. Prefer OIDC from CI too. Review with Access Analyzer.
Real example & use case
Upload service role scoped to s3://uploads/prod/users/*.
Pros & cons
Pros: limited blast radius. Cons: debugging AccessDenied needs CloudTrail.
#aws#iam#security