The idea that only the minimum permission necessary for a task should be granted.
A basic principle of IAM policy design: rather than granting broad access and then narrowing it, it's recommended to first identify the necessary actions and build permissions up from there. Tools also exist to narrow permissions based on actual usage.
© 2026 ITBGM