Security
A least-privilege IAM policy for connecting a tool to AWS
Instead of attaching AdministratorAccess, scope the IAM user to exactly the actions a tool uses. Here's how to think about a least-privilege policy for Korve.
The fastest way to connect any tool to AWS is to attach AdministratorAccess to an IAM user and move on. It's also the way that keeps security teams up at night. A better habit — for Korve or any tool — is least privilege: grant only the actions the tool actually performs, and nothing else.
Why it matters
An access key is a credential. If it leaks — committed to a repo, pasted in the wrong place — the blast radius is whatever that key can do. A key scoped to "manage S3 and EC2 in one account" is a bad day. A key with AdministratorAccess is a catastrophe. Scoping the policy turns the worst case from "everything" into "the specific things this tool was allowed to touch."
How to scope it
Korve only calls the AWS actions behind the features you use — creating and reading resources, wiring IAM between them, sampling cost and state. It publishes an exact policy listing those actions so you never have to guess or over-grant. Rather than AdministratorAccess, you attach that policy and the key can do precisely what the product does and nothing more.
The shape of a good scoped policy:
- Read actions for the resource listings and cost views (
Describe,List,Get*). - Create/modify actions only for the services you'll actually deploy.
- IAM actions limited to creating the roles and policies that connections require.
- No
"*"on actions where a concrete list will do.
Start read-only, then widen
A safe on-ramp: attach ReadOnlyAccess first. Korve's inventory, cost, and drift views all work read-only — you can explore your whole account without granting a single mutating permission. When you're ready to actually deploy, widen to the scoped create policy for just the services you need.
Keep the key rotatable
Least privilege pairs with rotation. Because it's an ordinary IAM user access key, you can rotate or revoke it in the console at any time, and the tool's access changes instantly. Set a calendar reminder to rotate it, and delete keys you're no longer using.
Related
Build this on a canvas instead of the console.
Start Korve free →