Amazon

A security audit has flagged the IAM user app-deployer for having AdministratorAccess policy with far more permissions than needed. The user only needs access to:

• S3: Read (GetObject) and Add objects (PutObject), list buckets (ListBucket).
• CloudWatch Logs: Create log groups (CreateLogGroup), log streams (CreateLogStream), and put log events (PutLogEvents).

An internal serverless API is needed for order management. Orders must be stored in a DynamoDB table with all access routed through a Lambda function — never direct database access. The Lambda execution role should follow least-privilege principles, limiting permissions to only what's necessary.

During an incident investigation, you pulled a massive log export from /var/log/app/access.log that's several gigabytes in size. Your analysis tools and editors can't handle the entire file at once.