Question

A company runs hundreds of projects, each with its own set of EC2 instances, S3 buckets, and DynamoDB tables. Every resource is tagged with a 'project' key. The security team wants developers to be able to manage only the resources belonging to their assigned project, without writing a separate IAM policy per project. Each developer's IAM principal is tagged with the project they belong to. Which approach best implements least privilege at scale?

Accepted Answer

Write a single ABAC policy that grants actions with a condition requiring aws:ResourceTag/project to equal aws:PrincipalTag/project.

Answer

Create one IAM policy per project that lists each resource ARN explicitly, and attach the correct policy to each developer group.

Answer

Grant developers full administrative access and rely on AWS Config rules to detect and remediate any cross-project access after the fact.

Answer

Use a permissions boundary on each developer that references the project name in a hardcoded aws:RequestedRegion condition.