IAM Policies That Ship Without a Wildcard

به چه درد می‌خورد

سیاست دسترسی‌ای که ستاره دارد همیشه کار می‌کند و همین آرامش خطرناک است. این متن پیش از تولید هر سیاست دسترسی یا منبع، ابزار را به نوشتن حداقل دسترسی وادار می‌کند و بعد نشان می‌دهد چطور فهرست مجوزها را از روی کد خودت دربیاوری، نه از روی حدس: اجرای واقعی مسیر، خواندن خطاهای دسترسی، و اضافه کردن همان یک مورد کم. اگر فایل مقصد اصلا کامنت نمی‌پذیرد، قاعده‌ها را به‌جای فایل در خود گفتگو بگذار.

خود اسکیل کپی

Use this before you let an assistant generate a policy, a role, or a resource
block. In Terraform or CloudFormation YAML, paste it as a comment above the
section, one # per line. In CDK TypeScript, use //. A raw .json policy file
has no comment syntax at all — there, put these rules in the chat turn instead
of in the file.

# Rules for any IAM or infrastructure suggestion here:
# - No "*" in Action. List each API action by name.
# - No "*" in Resource. Scope to the exact ARN, or to a pattern bounded by
#   account, region, and a name prefix.
# - No AdministratorAccess, no PowerUserAccess, no *FullAccess managed
#   policy. If one is proposed, replace it with the actions the code calls.
# - A trust policy names one principal. Trusting a whole service with no
#   condition is rejected.
# - Any cross-account or public-read setting is written explicitly with a
#   comment saying why, or it is left out.
# - Buckets, queues, and tables default to encrypted and non-public.
# - Secrets are referenced, never literal.

Then prove the list against your own source. This part stays out of the file:

- Grep your source for the SDK calls it makes. Every action in the policy must
  map to one, and every call must have an action.
- Delete every action you cannot point at a line of code for.
- Deploy it, run the real path once, and read the access-denied errors. Adding
  what is missing is safe. Guessing what might be needed is not.
- Re-run this the day you delete code. Permissions outlive their callers.

Failure this prevents: a generated policy that works instantly because it
grants everything, passes review because it is short, and is still there two
years later when the key leaks.

نصبش چطور است کپی

1. Open the tool and start a new conversation, project or template.
2. Paste the text below wherever the tool keeps standing instructions
   — usually called system prompt, instructions, or persona.
3. Save it so it applies to every run rather than a single message.

برای تو جواب داد؟

از کجا آمده