Title: Discussion 6 — Tightening Least Privilege in Your Capstone
Course: AIINFRA 303: Capstone Project > Section: Week 06 — Deploying to the Cloud with Infrastructure as Code

💬 Discussion 6 — Tightening Least Privilege in Your Capstone (20 pts)

Look at the infrastructure you provisioned in this week's lab (or the fuller architecture you're planning for your capstone). Identify one IAM permission or one open network port in your design that violates the principle of least privilege — for example, an IAM policy statement using "Action": "*" instead of naming specific actions, a security group allowing inbound traffic from 0.0.0.0/0, or a storage bucket left publicly readable when it doesn't need to be. In your post, address:

1. What is the over-broad permission or open port? Be specific — name the resource and the exact policy/rule.
2. What's the realistic worst case if that permission or port were exploited?
3. How would you tighten it? Describe the specific change (e.g., scope the IAM action to s3:GetObject on a specific bucket ARN, restrict the security group to your own IP or a specific CIDR range, flip the bucket back to private and use signed URLs instead).

Then respond to at least two classmates — look at the two you're replying to and note whether their proposed fix could be even tighter, or whether it might be too restrictive and break something they actually need.