Parks staff only need to read objects in one Amazon S3 bucket for seasonal reports. How should permissions be granted under the principle of least privilege?
Select an answer to reveal the explanation.
Short Explanation
Least privilege means handing someone the key to one filing cabinet drawer — not the entire city hall master ring. Parks readers get S3 read on that bucket, not admin on everything. Broad AdministratorAccess or root sharing is the opposite pattern.
Full Explanation
The principle of least privilege requires granting only the permissions needed to perform a job. For parks staff who only read one bucket, an IAM group policy (or equivalent) limited to the necessary S3 read actions on that bucket is appropriate. AdministratorAccess, root sharing, and blanket s3:* across accounts violate least privilege and expand blast radius.