ENFORCING LEAST PRIVILEGE IN AWS IAM WITH ACCESS ANALYZER AND LAST ACCESS DATA

Summary from the TLDR InfoSec newsletter

This post demonstrates how to utilize AWS IAM Access Analyzer to audit external access, followed by further fine-tuning with Last Access Data to identify unused permissions. Policies can then be refined by using CloudTrail to view the actual API calls made by a role and feeding those into the IAM Policy Simulator to determine the minimum required permissions. Least privilege reviews can be automated using Lambda, and real-time detection can be enabled using CloudTrail with EventBridge.