The token works.
It opens everything,
so it never fails,
and because it never fails
nobody ever looks at it again.
That is the danger.
The credential that can do anything
is the credential
you most want to lose,
because whoever finds it
inherits your whole kingdom
with one copied string.
There is a slower, safer way.
Give the process
the least it needs
to do its one job.
Read-only if it only reads.
One bucket if it uses one bucket.
One table, not the schema.
An hour, not forever.
It feels like extra work.
It is extra work,
right up until the day
something leaks,
and then it is the wall
between an incident
and a catastrophe.
Least privilege
is not distrust of your people.
It is respect for the accident
that has not happened yet.
The intern's script,
the forgotten cron job,
the third-party library
you never read,
each of them holds
exactly the power you handed it,
and none of them
will hand it back
if they are compromised.
So scope it down.
Ask of every permission,
does this thing
actually need this,
and if the answer is
"probably not, but just in case,"
that just-in-case
is the breach
writing its own invitation.
The blast radius
is not decided
on the day of the attack.
It is decided now,
quietly,
in the grants you approve
without reading.
A key that opens one door
is a small loss.
A key that opens every door
is the end of the story.
Hand out the small keys.
Make the powerful ones
rare,
watched,
and short-lived.
The most secure permission
is the one
you never granted.
– Serguey Asael Shinder
Top comments (0)