Least privilege people do not route around
Read, write and delete are separate grants — give exactly the one the job needs.
“Just give them the shared IAM user for now, we will tighten it later”
What the wait costs
Over-provisioning is what happens when the granular option is slower than the blunt one.
In Fenwave
Platform Settings›Storage connections›Permissions
Capability
Object StorageLeast privilege fails in practice because writing a scoped IAM policy takes twenty minutes and attaching the existing broad one takes twenty seconds. Fenwave models object storage permission as four separate grants — read, create, update, delete — each of which can be narrowed to a single storage connection. Giving someone upload-only access to one bucket is now the faster option, which is the only way least privilege survives contact with a deadline.
How it works
- 01Create a storage connection for the bucket in Platform Settings.
- 02Grant read, create, update or delete independently.
- 03Scope the grant to that connection alone.
- 04Assign it to a group so joiners and leavers are handled by membership.