How do you implement least-privilege access in DevOps?
Quick Answer
Grant each identity (user, service, workload) only the permissions it needs, prefer short-lived credentials over static keys, use IAM roles and Kubernetes RBAC scoped per workload, enforce MFA, and review/audit access regularly.
Detailed Answer
Least privilege limits blast radius when something is compromised. Practically: role-based, scoped permissions; per-service identities (IAM roles/IRSA, dedicated K8s service accounts); no shared or long-lived admin creds; just-in-time elevation where possible; and periodic access reviews to remove creep. Automate policy checks so over-broad grants fail review.
Interview Tip
Frame it as limiting blast radius and mention per-workload identities + short-lived credentials — concrete mechanisms, not just the slogan.