Privilege creep is the enemy
Least privilege means each identity gets only the access it needs. The hard part is keeping it that way. Over time roles accumulate permissions through one off grants that are never revoked, leaving accounts vastly over privileged. This is privilege creep.
Techniques that scale
- Role based access groups permissions into roles tied to job function, not individuals.
- Attribute based access decides using attributes like team, environment, and resource tags for finer control.
- Just in time access grants elevated rights temporarily and expires them automatically.
- Access reviews periodically force owners to reconfirm or revoke each grant.
Detecting over provisioning
Compare granted permissions against used permissions from audit logs. Permissions never exercised over months are strong candidates for removal. Automating this right sizing keeps the gap between granted and needed small.
Key idea
At scale least privilege is a continuous process of granting narrowly, expiring temporary access, and revoking permissions that usage shows are unused.