What is 'cloud IAM least privilege' for a web application's service account, and what principle should guide IAM policy creation?

• A.The application's IAM role should be a member of a broad PowerUser group during development: s3:* on arn:aws:s3:::* (a wildcard that avoids denied calls), dynamodb:* on all tables, ssm:* on the account. Permissions are tightened later by a security team, in case of compromise the blast radius is limited to the services named in the policy, a boundary that IAM enforces for each region of the deployment pipeline, a rule that audit reports list under findings
• B.The service account should inherit the permissions of the developer who deployed it: read from every bucket (s3:GetObject on arn:aws:s3:::*), write to every table, read the full Parameter Store. This keeps deployments from failing with AccessDenied, a trade-off that security teams accept when the account sits in a private subnet with no route to the internet, a setup that the network team documents in the runbook of the service for each release
• C.Permissions should be granted per environment rather than per function: a single production role with s3:GetObject (arn:aws:s3:::prod-*), dynamodb:PutItem on all tables, ssm:GetParameter on the root path /. Wildcard Resources are fine for read actions, in case of compromise the attacker reaches each production bucket, a limit set by the environment boundary rather than the account. Role names follow the pattern prod-app-role for the application