Question

A security audit of your company's cloud environment reveals that an application service account has been granted a broad administrator policy, even though the application only reads objects from a single storage bucket and writes log entries to one logging service. The audit flags this as a violation of least privilege. What is the MOST appropriate remediation?

Accepted Answer

Replace the administrator policy with a custom policy granting only read access to the specific bucket and write access to the logging service

Answer

Enable MFA on the service account to compensate for the excessive permissions

Answer

Move the application to a separate network segment protected by a firewall

Answer

Rotate the service account credentials on a more frequent schedule