AWS IAM: excessive permissions are debt that compounds with interest
DeveloperFullAccess is not faster — it is more dangerous. IAM patterns we use in SMB client accounts without freezing delivery.
AWS Security Blog repeats: long-lived access keys and AdministratorAccess policies are post-breach vector #1. In LatAm SMB accounts we inherit personal IAM users with keys on laptops, no rotation since 2020. CIS AWS Benchmark penalizes exactly this.
SSO and roles instead of static keys
Recommended pattern: SSO (Identity Center) for humans, roles per environment (dev/staging/prod), service roles for apps with policies scoped to specific resource ARNs. Remove static keys where IAM roles for tasks/instance profiles suffice.
Permission boundaries on dev accounts prevent errant scripts from accidentally creating admins. Access Analyzer finds externally shared resources — run monthly; costs minutes, saves public embarrassment.
A quarterly access review process
Process: each new AWS service requests documented minimum policy in PR. Quarterly review of inactive users and policies with Action "*" without condition. NIST recommends access recertification; for 20 users that is a one-hour meeting, not an enterprise project.
Boring IAM is secure IAM. Your developer in Carolina can still deploy fast with a deploy role scoped to one bucket and one Lambda — they do not need god mode because "it was always that way."
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
