Principle of Least Privilege

package com.bank.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class LeastPrivilegeConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
            // Reporting service: read-only scope
            .requestMatchers("/api/v1/reports/**")
                .hasAuthority("SCOPE_account:read")
            // Transfer service: write scope required
            .requestMatchers("/api/v1/transfers/**")
                .hasAuthority("SCOPE_transfer:write")
            // Admin endpoints: admin scope only
            .requestMatchers("/api/v1/admin/**")
                .hasAuthority("SCOPE_admin")
            .anyRequest().denyByDefault()
        );
        return http.build();
    }
}

Reporting service (scope=account:read):
  GET /api/v1/reports/balances --> 200 OK
  POST /api/v1/transfers      --> 403 Forbidden (no write scope)
  GET /api/v1/admin/users      --> 403 Forbidden (no admin scope)

-- Least privilege database grants
CREATE USER reporting_user WITH PASSWORD 'strong_pass';
GRANT SELECT ON accounts, transactions TO reporting_user;
-- Cannot INSERT, UPDATE, DELETE, or DROP anything

CREATE USER transfer_user WITH PASSWORD 'strong_pass';
GRANT SELECT, INSERT ON transactions TO transfer_user;
GRANT SELECT, UPDATE ON accounts TO transfer_user;
-- Can read and modify needed tables, but cannot DROP or access admin tables

CREATE USER admin_user WITH PASSWORD 'strong_pass';
GRANT ALL ON ALL TABLES TO admin_user;
-- Full access, but this account is never used by the application
-- Only used by DBAs with MFA and audit logging

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": "arn:aws:s3:::bank-statements-bucket/*"
    }
  ]
}

WRONG (wildcard):
  "Action": "*",
  "Resource": "*"
  --> Service can do ANYTHING to ANY resource!

CORRECT (least privilege):
  "Action": ["s3:GetObject", "s3:PutObject"],
  "Resource": "arn:aws:s3:::bank-statements-bucket/*"
  --> Service can only read/write to one specific bucket

package com.bank.security;

import java.time.Instant;
import java.time.Duration;

public class JitElevationService {

    public ElevationGrant requestElevation(String adminUser, String permission,
                                           Duration duration) {
        Instant expiry = Instant.now().plus(duration);
        ElevationGrant grant = new ElevationGrant(adminUser, permission, expiry);
        System.out.println("Granted " + permission + " to " + adminUser
            + " until " + expiry);
        return grant;
    }

    public boolean isElevated(ElevationGrant grant) {
        boolean active = Instant.now().isBefore(grant.expiry());
        if (!active) {
            System.out.println("Elevation expired for " + grant.user());
        }
        return active;
    }

    record ElevationGrant(String user, String permission, Instant expiry) {}
}

Granted account:unlock to priya_admin until 2024-10-27T10:10:00Z
10 minutes later:
Elevation expired for priya_admin
--> Admin loses elevated access automatically

package com.bank.service;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;
import java.math.BigDecimal;

@Service
public class TransferService {

    @PreAuthorize("hasRole('TELLER')")
    public String initiateTransfer(String from, String to, BigDecimal amount,
                                   String initiator) {
        // Teller creates the transfer request
        return "Transfer initiated by " + initiator + ": "
            + amount + " from " + from + " to " + to;
    }

    @PreAuthorize("hasRole('MANAGER') and #approver != #initiator")
    public String approveTransfer(String transferId, String approver,
                                  String initiator) {
        // Manager approves, but cannot be the same person who initiated
        return "Transfer " + transferId + " approved by " + approver;
    }
}

Priya (TELLER) initiates transfer --> OK
Priya (TELLER) approves same transfer --> 403 Forbidden (same person)
Rajesh (MANAGER) approves --> OK (different person)

Anti-patterns:
  1. Wildcard:  "Action": "*", "Resource": "*" (grants everything)
  2. Shared:    One admin account used by 5 people (no accountability)
  3. Creep:     Temporary admin grant given 6 months ago, never revoked
  4. Root:      Application running as root/superuser (full OS access)
  5. All-ports: Security group allowing 0.0.0.0:0-65535 (all traffic)

Fixes:
  1. Specific actions on specific resources
  2. Individual accounts with individual audit trails
  3. Regular access reviews + automated expiry
  4. Non-root service accounts with minimal permissions
  5. Allow only required ports from required sources

package com.bank.security;

import java.util.Set;

public class AccessReviewer {

    public void review(String service, Set<String> granted, Set<String> used) {
        Set<String> unused = new java.util.HashSet<>(granted);
        unused.removeAll(used);

        if (!unused.isEmpty()) {
            System.out.println("WARNING: " + service + " has unused permissions: "
                + unused);
            System.out.println("Recommendation: remove " + unused);
        } else {
            System.out.println(service + ": all permissions actively used.");
        }
    }
}

WARNING: reporting-service has unused permissions: [account:write, admin]
Recommendation: remove [account:write, admin]