Comparison
Permission boundaryvsPrivilege creep
Permission boundary
teams can create their own roles, and none of the roles they create can exceed the ceiling you set.
A policy that caps the maximum permissions an identity can ever have, regardless of what is granted to it. It is what makes delegating permission management safe, because it separates 'who may grant' from 'what may be granted'. Without one, giving a team the ability to create roles is equivalent to giving them administrator access, via one extra step.
Full entry →Privilege creep
the role was widened during an incident three years ago and nothing has ever narrowed it again.
The one-way accumulation of permissions over time, because granting is urgent and revoking never is. It is why the average production role bears no resemblance to what the workload uses, and why access reviews find identities with permissions for systems that no longer exist. The practical counter is data rather than diligence: most clouds report which permissions an identity has actually used, and the unused ones are the list.
Full entry →