How do you actually implement least privilege in IAM?

Start from a deny by default position and grant permissions based on observed usage rather than guesses. Generate an initial policy from access logs, scope it with resource ARNs and condition keys instead of wildcards, and give every workload its own role. Add organization level guardrails such as service control policies and permission boundaries so nobody can grant themselves more, then review unused permissions on a schedule and trim.

The trap is trying to write the perfect policy up front, which either blocks the team or ends as a wildcard because everyone got tired. What works is starting broad in a non production account, capturing what the workload actually calls from the audit trail, and generating a policy from that. Then I tighten it: real resource ARNs rather than a star, and condition keys where they matter, so a role can only assume things from our own accounts or only act in one region. Every workload gets its own role rather than sharing a big application role, because shared roles are how one service ends up able to delete another's data. Above that sit organization level guardrails, service control policies denying whole categories like disabling logging or creating public buckets, plus permission boundaries so a team can create roles without escalating beyond their limit. Then review: unused access reports monthly, and anything untouched for ninety days gets removed. Permissions only ever grow unless somebody makes trimming a habit.