Glossary · Phase 11 · Professional practice
Least privilege
Giving each person or service only the actions, on only the resources, its job needs, so a mistake or a leak can do little harm.
The principle behind it all is least privilege: give each principal the smallest set of actions on the smallest set of resources that lets it do its job.
Try it now
Match the shape of the work to the way it runs: always on, packaged and scaled, or only when called.
Learn it properly
Cloud for AI engineers · Access policies and least privilege, storage, compute choices, managed model endpoints, secrets and budgets. About 30 minutes.
Other terms from the same lesson
- egress: Data leaving a cloud provider's network, usually to the internet, which providers charge for by the gigabyte.
- IAM: A cloud's system of identities and policies that decides who may do what to which resource.
- presigned URL: A link signed with your credentials that grants access to one stored object and expires after a short time.
- service account: An identity a program uses to call cloud services, with its own narrow permissions, instead of a person's login.
- workload identity: Short-lived credentials a cloud gives a running service automatically, so there's no long-lived key to store or leak.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.