IAM least privilege for automation: roles, not keys

TL;DR

Use ARNs like arn:aws:s3:::[bucket]/[prefix]/ rather than. Run IAM Access Analyzer on the role periodically and remove unused permissions.

Steps

1. Start with an AWS managed policy that roughly fits the job.
2. Narrow it: only the actions the job needs, only the resources it touches. Use ARNs like arn:aws:s3:::[bucket]/[prefix]/ rather than .
3. Run IAM Access Analyzer on the role periodically and remove unused permissions.
4. Delete access keys that are not attached to a human workflow. If a key must exist, rotate it on a schedule and alert on keys older than 90 days.

When to use

You are seeing this: No root credentials and no long-lived IAM user keys in agent context, code, chat logs, or CI secrets. Use this skill when you run into "IAM least privilege for automation: roles, not keys".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Distills the AWS IAM best practices: protect root credentials, require MFA, apply least-privilege permissions, prefer IAM roles over long-term credentials, and use OIDC federation for workloads outside AWS. Verified against the live IAM user guide. https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html