Least-Privilege IAM and Encryption by Default
least-privilege-iam-and-encryption-by-default · always_apply: yes
Content
Use IAM user/role policies (not just bucket ACLs) scoped to what each ingestion function and analytics tool actually needs. Encrypt data at rest with SSE-KMS and S3 Bucket Keys (bucket_key_enabled=True on raw, curated, and Athena-results buckets) and keep API tokens for GitLab/GitHub/Jira in Secrets Manager or SSM Parameter Store — never in code or SAM templates.
Details
- Slug:
least-privilege-iam-and-encryption-by-default- Always apply:
- Yes
- Created:
- Aug 31, 2026
- Updated:
- Sep 15, 2026
Playbook
Activities 5
- Stand Up Serverless Ingestion from Scoped Sources Build the Operational Data Lake Pipeline
- Backfill Historical GitHub Events Build the Operational Data Lake Pipeline
- Store Compressed and Partitioned in S3 Build the Operational Data Lake Pipeline
- Present the Catalog via Athena Build the Operational Data Lake Pipeline
- Model the Data Lake as CDK Stacks Model and Deploy Infrastructure as Code