Harden resource and service-role policies

Every control in this group costs nothing in AWS spend to fix. Scoping a full-admin policy, attaching a service role to a stack, or adding a resource policy to an event bus are configuration changes, not paid features. The financial relevance is entirely on the risk side: these grants are the precondition for turning one leaked credential, one bad commit or one poisoned template into an account-wide incident.

The most concrete cost scenario is a leaked over-privileged credential. Automated bots crawl public code repositories for AWS keys continuously, and a leaked key with full admin is typically used to launch large compute fleets across every Region for cryptocurrency mining, generating five-figure bills within hours. A scoped policy makes the same leaked key nearly worthless. The same shape applies to a roleless deploy pipeline: a compromise inherits the deployer's full reach rather than a stack's narrow footprint.

Frame each finding by leak risk. A full-admin policy attached to a CI role that touches source control is the urgent one, because those are the credentials that actually leak; a documented break-glass admin role is a justified residual. These controls also map to PCI DSS, CIS and NIST least-privilege requirements, so an open finding surfaces in a SOC 2 exception or a customer security review and can stall a deal, a budget event finance owns even though the finding never hits the cloud invoice.

Devon brings the Security Hub policy-hardening export to his finance partner at the Series B company. The instinct in the room is to size a remediation budget, and the answer reframes the conversation immediately: scoping a full-admin policy, attaching a service role to a CloudFormation stack, or adding a resource policy to an event bus are configuration changes, not paid features. None of them shows up on the AWS bill. So this is not a spend item at all, it is a tail-risk item, and the finance question is which of these grants is the precondition for turning one leaked credential into an account-wide incident.

The way Devon's partner sizes it is by leak risk, not by finding count. The IAM.1 full-admin policy attached to the CI role that runs on every merge is the urgent one, because CI credentials are exactly the kind that get committed to a public repository and found by automated scanners within minutes, with a five-figure cryptomining bill arriving before the billing alarm fires. A documented break-glass admin role used by two named people is a justified residual the partner can accept. She ranks the findings by what actually leaks, gives the source-control-touching and IAM-managing roles committed dates, and funds the permission boundary and SCP guardrail so the wildcard grant cannot reappear one ticket at a time.

The cost model here is asymmetric. There is no recurring line item for an over-broad policy; its cost is zero until the day it is not, and then it is potentially enormous. The expected-value framing is the right one: a small ongoing probability of a leaked or compromised credential, multiplied by a very large impact, account-wide compromise, runaway bills, breach response and regulatory exposure.

The most concrete financial scenario is runaway compute from a leaked over-privileged key, documented at five figures in hours, because the leaked credential could spin up any resource at any scale. The same shape applies to a roleless deploy pipeline whose compromise inherits the deployer's full reach. Cleaning these up is buying down tail risk at near-zero cost.

There is also a real audit-and-deals dimension. These controls map to PCI, CIS and NIST least-privilege requirements, so an open finding surfaces in a SOC 2 exception or a customer security review and can stall a contract; deal slippage and audit remediation are budget events even though the finding never appears on the cloud bill. The finance role is to make remediation a tracked, owned, time-boxed commitment, prioritise by leak risk, and watch the trend, accepting a small justified residual rather than demanding an unrealistic zero.

These findings are about the difference between trust and policy. A credential that can do anything, a deploy pipeline that borrows admin, an event bus that anyone in the account can publish to: each turns a routine leak or a bad change into a whole-account event rather than a contained one. The report shows them as a scatter of separate findings.

The leadership question is not the count; it is whether broad access is the exception, granted deliberately and owned, or the default that nobody narrowed. The defensible end state is a small, justified set of broad grants, with everything else scoped tight and the broad path requiring explicit sign-off, enforced by a guardrail rather than a guideline.

None of this is a cost decision; the fixes are free. It is a governance decision about whether permissions are granted on purpose or handed out broadly because it was faster.

After a customer security questionnaire asked the company to attest that automation never runs with full admin, the executive team stopped treating the IAM, CloudFormation and EventBridge findings as separate engineering tickets. A credential that can do anything, a deploy pipeline that borrows admin, an event bus anyone in the account can publish to: these were not a dozen problems but one question the company could not answer cleanly. Broad access granted on purpose and owned is a control the business can attest to. Broad access nobody narrowed is an assumption written on an audit finding.

Leadership set the end state rather than the implementation: a small, justified set of broad grants, everything else scoped tight, and the broad path requiring explicit sign-off enforced by a guardrail rather than a guideline. Because the fix is free, this was never a budget decision. Because the downside spans breach risk, runaway cost and revenue risk at once, it was one of the rare items a CFO, a CISO and a head of sales all cared about, and the decision they made was simply whether permissions are granted deliberately or handed out broadly because it was faster.

These are the access findings most likely to turn an ordinary credential leak or a routine deploy into a serious incident. A small, stable, well-justified set means access discipline is working; a growing count means broad and implicit permissions are being handed out by default, and the same pattern is almost certainly present in the access you cannot see on one dashboard.

Because the fix is free and the downside spans breach risk, runaway cost and revenue risk at once, this is one of the rare items a CFO, a CISO and a head of sales should all care about. The leadership move is to make broad access a deliberate exception, keep automation away from full admin and roleless deploys, and back the standard with a guardrail so the broad or implicit grant cannot reappear one ticket at a time.