Least privilege is the IAM principle everyone agrees with and few actually implement, because doing it by hand is tedious and "Action": "*" always works. Here's a practical approach that gets you most of the way without turning into a full-time job. Why it matters An over-permissive role is a standing risk: if the credentials leak or a service is compromised, the blast radius is everything that role can touch. Least privilege shrinks that blast radius to "only what this thin...