Build a policy from denials instead of from guesses

short · 50 min · Objective 4.2

Task

Start a workload with no permissions at all, run it, read each denial, and grant exactly what failed. The alternative -- grant broadly and narrow later -- never narrows, and this lab is the method that actually produces least privilege.

Steps

  1. Write a small application that does four things: lists a bucket, reads one object, writes one object, and reads a secret.
  2. Create an identity with NO permissions and run the application. Capture the first denial verbatim in lab/denials.txt, including the action name and the resource.
  3. Grant exactly that one action on exactly that one resource. Re-run, capture the next denial, and repeat until the application completes.
  4. Record the final policy in lab/policy.json and count its statements. Compare it against the policy you would have written from memory before starting -- write both and diff them.
  5. Now scope the RESOURCES as well as the actions: replace any wildcard resource with the specific one, re-run, and confirm it still works.

Verify

grep -Ec 'den|not authoriz|forbidden' lab/denials.txt
grep -c '\*' lab/policy.json
python -c "import json;d=json.load(open('lab/policy.json'));print(len(d.get('Statement',d)),'statement(s)')"

At least four denials captured, and the wildcard count should be zero or justified in a comment. A policy built this way is usually smaller and more specific than the one you would have written from memory -- record whether yours was.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.