json 15 lines · 1 tab

Least privilege IAM policy for an application on AWS

Kai Nakamura Apr 2026

1 tab

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::codesnips-assets-production/*"]
    },
    {
      "Effect": "Allow",
      "Action": ["kms:Decrypt"],
      "Resource": ["arn:aws:kms:us-east-1:123456789012:key/abcd-1234"]
    }
  ]
}

1 file · json Explain with highlit

Cloud IAM mistakes become high-impact quickly, so I keep policies narrow and resource-scoped. Wildcards are convenient until they become an incident report. The baseline question is always the same: what exact actions on what exact resources does this workload need right now.

Related snips

hcl

# AWS Lambda Function with API Gateway trigger

# === Lambda function ===
resource "aws_lambda_function" "api_handler" {
  function_name = "${var.project}-api-handler"
  description   = "API request handler for ${var.project}"

AWS Lambda serverless functions with Terraform

aws lambda serverless

by Ryan Nakamura 1 tab

package files

import (
  "context"
  "time"

Presigned S3 upload URLs (AWS SDK v2)

go aws s3

by Leah Thompson 1 tab

json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyInsecureTransport",
      "Effect": "Deny",

S3 bucket policy that enforces TLS and blocks public reads

s3 aws tls

by Kai Nakamura 1 tab

yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: metrics-reader
  namespace: production
---

Kubernetes RBAC roles with least privilege service accounts

kubernetes rbac least-privilege

by Kai Nakamura 1 tab

hcl

# RDS PostgreSQL instance
resource "aws_db_instance" "main" {
  identifier = "${var.project_name}-db"

  engine         = "postgres"
  engine_version = "16.1"

Terraform AWS RDS and ElastiCache provisioning

terraform aws rds

by Ryan Nakamura 1 tab

hcl

# AWS VPC with public/private subnets across 3 AZs

data "aws_availability_zones" "available" {
  state = "available"
}

AWS VPC and networking with Terraform

aws vpc terraform

by Ryan Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Least privilege IAM policy for an application on AWS — share card

Link copied