What does the 'principle of least privilege' mean when writing IAM policies?
A.Grant only the permissions required to perform a task — nothing more
Correct — the definition of least privilege.
B.Grant administrator access and remove it when no longer needed
Granting admin first violates the principle outright.
C.Use groups instead of individual user policies
Groups are a management convenience — the principle is about permission scope, not attachment style.
D.Deny all actions by default and never add allows
Deny-all breaks everything; least privilege still grants what's needed.
Why this answer
Least privilege = minimum permissions to do the job. It's an IAM best practice and an exam staple: start narrow, add only what a workload actually needs.
Correct answer: A · Last reviewed 2026-11-01
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Security Basics practice session.
Practice Security Basics