AWS IAM: excessive permissions are debt that compounds with interest
DeveloperFullAccess is not faster — it is more dangerous. IAM patterns we use in SMB client accounts without freezing delivery.
AWS Security Blog repeats: long-lived access keys and AdministratorAccess policies are post-breach vector #1. In LatAm SMB accounts we inherit personal IAM users with keys on laptops, no rotation since 2020. CIS AWS Benchmark penalizes exactly this.
Recommended pattern: SSO (Identity Center) for humans, roles
Recommended pattern: SSO (Identity Center) for humans, roles per environment (dev/staging/prod), service roles for apps with policies scoped to specific resource ARNs. Remove static keys where IAM roles for tasks/instance profiles suffice.
Permission boundaries on dev accounts prevent errant scripts
Permission boundaries on dev accounts prevent errant scripts from accidentally creating admins. Access Analyzer finds externally shared resources — run monthly; costs minutes, saves public embarrassment.
Process: each new AWS service requests documented minimum policy in PR. Quarterly review of inactive users and policies with Action "*" without condition. NIST recommends access recertification; for 20 users that is a one-hour meeting, not an enterprise project.
Boring IAM is secure IAM. Your developer in Carolina can still deploy fast with a deploy role scoped to one bucket and one Lambda — they do not need god mode because "it was always that way."
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
