IAM: what does “least privilege” mean and why does it matter?

Answer

Least privilege means giving only the minimum permissions needed to do the job (no more). It limits blast radius: if a key or service is compromised, the attacker can do less damage.

{
  "Effect": "Allow",
  "Action": ["s3:GetObject"],
  "Resource": ["arn:aws:s3:::my-bucket/*"]
}