IAM / ACCESS REVIEW — TABLETOP ONLY
Principal and job purpose:
Authentication/temporary credential ownership:
Required action | exact permitted resource | reason | expiry | evidence
Which actions must be refused:
Avoid broad administrator privileges as a default. Separate human and workload identities.
No real IAM policy is created/applied by this kit. Permission simulation, provider-specific
semantics and actual access checks need a separately authorized environment.
Consider source files,DB,logs,backup access and recovery authority separately.
Public access=false in a local plan is NOT proof of real bucket/network policy enforcement.
