IAM policy patterns
Least-privilege examples for deploy users, asset buckets, logs, read-only diagnostics, and emergency break-glass access.
Takeaway
Deployment credentials should be narrow enough for routine releases and separate from read-only diagnostics or emergency access.
01
Split deploy and diagnostics
A CI deploy role usually needs write access to a specific bucket, invalidation access to a specific distribution, and read access to its own release state. It does not need broad account inspection permissions.
02
Prefer resource-scoped permissions
Policies should name the bucket, distribution, log group, and secret paths they need. Broad wildcard access makes the first launch easier but turns every later incident into a permissions audit.
03
Prepare emergency access separately
Break-glass access should be explicit, monitored, and rarely used. Keeping it separate from normal deployment protects the release path while still giving the team a way to recover from account or CI failures.