# Ensure Least Privilege Access

- Source: https://support.icompaas.com/support/solutions/articles/62000234448-ensure-least-privilege-access
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112688) › [CIS AWS Database Services Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169253)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability****:**

-   **Level 1**

**Description:**  
Ensure that permissions granted to IAM users, roles, and Aurora database accounts follow the principle of least privilege—only allowing the minimum access required to perform necessary functions.

**Rationale:** Applying least privilege limits the potential damage caused by accidental or malicious actions. It reduces the attack surface and helps maintain strong access control practices, both in IAM and within the database.

**Impact:** Careful permission scoping requires additional administrative effort, but it significantly improves security by avoiding overly permissive access.

**Default Value:** By default, IAM users and database users may be granted broad privileges unless explicitly restricted.

**Pre-requisites:**

-   IAM access with permissions to view users, roles, and policies  
    
-   Access to the Aurora database for reviewing user privileges  
    

**Remediation:**

### **Test Plan**

**Using AWS Console:**

1.  Sign in to the AWS Management Console  
    
2.  Navigate to IAM > Users and Roles  
    
3.  Review attached policies for each IAM identity  
    
4.  Verify permissions are scoped to specific services and actions  
    
5.  Connect to the Aurora DB via MySQL/PostgreSQL client  
    
6.  Run SHOW GRANTS FOR '<username>'@'<host>'; and confirm only required privileges are granted
    

**Using AWS CLI:**

1.  List all IAM users  
    
     aws iam list-users
    
      
    
2.  List all IAM roles  
    
     aws iam list-roles
    
      
    
3.  List attached policies for a user  
    
     aws iam list-attached-user-policies --user-name <username>
    
      
    
4.  List attached policies for a role  
    
     aws iam list-attached-role-policies --role-name <rolename>
    
      
    
5.  Review policy contents  
    
     aws iam get-policy-version --policy-arn <policy-arn> --version-id <version-id>
    
      
    

### **Implementation Plan**

**Using AWS Console:**

1.  Sign in to the AWS Console  
    
2.  Go to IAM > Users or IAM > Roles  
    
3.  Click the target user or role  
    
4.  Remove broad policies like AdministratorAccess  
    
5.  Attach fine-grained, least privilege policies (e.g., AmazonRDSReadOnlyAccess)  
    
6.  Log into the Aurora database  
    
7.  Create a new database user if needed  
    
8.  Grant only required privileges using SQL: GRANT SELECT, INSERT ON <database>.\* TO '<username>'@'<host>';  
    

**Using AWS CLI:**

1.  Detach broad policy  
    
     aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
    
      
    
2.  Attach least privilege policy
    
    aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess
    
      
    
3.  Log in to the Aurora database and run:  
    
     CREATE USER '<username>'@'<host>' IDENTIFIED BY '<password>';
     GRANT SELECT, INSERT ON <database>.\* TO '<username>'@'<host>';
    
      
    

### **Backout Plan**

**Using AWS Console:**

1.  Navigate to IAM > Users or Roles  
    
2.  Remove least privilege policy  
    
3.  Re-attach the previously used policy (if required)  
    
4.  Connect to the database  
    
5.  Revoke restricted privileges or drop the user  
    

**Using AWS CLI:**

1.  Detach least privilege policy  
    
    aws iam detach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AmazonRDSReadOnlyAccess
    
      
    
2.  Re-attach old policy  
    
     aws iam attach-user-policy --user-name <username> --policy-arn arn:aws:iam::aws:policy/AdministratorAccess
    
      
    
3.  Revoke or drop the user in Aurora:  
    
     REVOKE ALL PRIVILEGES ON <database>.\* FROM '<username>'@'<host>';
     DROP USER '<username>'@'<host>';
    
      
    

**References:**

-   [AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
    
-   [IAM database authentication](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html)
    
-   CIS AWS Database Services Benchmark v1.0.0, Section 2.8

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.