🧾 JSONmedium
3. Bound permissions to approved services
Write an IAM permissions-boundary policy that ALLOWS only the approved services (it caps the MAX permissions an identity can have). One statement: • Effect: "Allow" • Action: ["s3:*", "ec2:*", "logs:*"] • Resource: "*"
How to approach this
A permissions boundary is an IAM policy that sets the MAXIMUM permissions an identity can ever have — even if another policy grants more, the effective permissions are the INTERSECTION. Used in delegated/regulated environments so teams can create roles but never exceed an approved service set. Here an Allow on `s3:*`, `ec2:*`, and `logs:*` caps every bounded identity to just those services (least privilege at the org boundary).
config.json