Cloud IAM Least Privilege: A Practical Security Review Checklist
Review cloud identity permissions, service accounts, credential lifecycle, and audit logging using a least-privilege approach.
Inventory identities
List users, groups, service accounts, workload identities, external collaborators, and emergency accounts. Record ownership, purpose, and required business function.
Reduce excessive access
Identify broad administrator roles, wildcard permissions, and long-lived credentials. Narrow grants carefully, validate dependencies, and use staged changes with rollback plans.
Strengthen authentication
Require MFA for privileged users, prefer short-lived credentials or federation where supported, and keep secrets out of source code. Define rotation and revocation procedures.
Monitor sensitive changes
Enable protected audit logs and alert on privilege changes, unusual credential creation, public storage exposure, and attempts to disable logging.
Review continuously
Repeat reviews after deployments, incidents, acquisitions, and role changes. Give exceptions an owner and expiry date; document residual risk.