Enforce Least Privilege with IAM Policies & SCPs

Quick Answer

Enforcing least privilege in AWS is about applying restriction at two different layers that reinforce each other rather than relying on a single control. IAM policies attached to individual users or roles should be scoped to grant only the specific actions those principals actually need, the fine-grained, per-principal layer of least privilege. Service control policies operate at a different layer: attached to an organizational unit or account within AWS Organizations, they set an outer boundary on what any principal in that account can ever do, regardless of how permissive their individual IAM policies might be, making them effective for enforcing guardrails consistently across every account and user at once. The options that fail here all share the same problem: they grant broad or unrestricted access rather than narrowing it, whether that is using the root user for routine administrative tasks, writing a bucket policy that opens access to every IAM user instead of specific ones, or attaching a fully permissive managed policy like AdministratorAccess to a principal that doesn't need it. When a question asks which actions enforce least privilege, look for mechanisms that narrow or restrict what is allowed, applied at either the individual policy level or the organizational boundary level, and treat any option that broadens or grants blanket access as automatically disqualified no matter how convenient it sounds.