c5.4 Grant agents least-privilege roles with no escalation path

An autonomous agent inherits its role's reach

An agent acts on your behalf using its IAM role. If that role is broad — or, worse, holds permissions that let it change its own permissions — a manipulated or compromised agent doesn't just misuse what it has; it can escalate to more. Scope the role to only the tools, resources, and secrets the agent needs, and explicitly slam the door on the handful of permissions that enable privilege escalation.

Grant only what the agent's task requires

Start from nothing and add the specific actions and resource ARNs the agent uses — the same least-privilege discipline as the model-invoke and tool roles:

{
  "Sid": "AgentTaskPermissions",
  "Effect": "Allow",
  "Action": ["bedrock:InvokeModel", "dynamodb:GetItem"],
  "Resource": [
    "arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-3-5-sonnet-20240620-v1:0",
    "arn:aws:dynamodb:us-east-1:111122223333:table/AgentState"
  ]
}

Explicitly deny the escalation paths

A short, well-known set of IAM/STS actions turns a limited role into an admin one. Even if they are never granted, an explicit Deny guarantees a widened policy can't reintroduce them:

{
  "Sid": "NoPrivilegeEscalation",
  "Effect": "Deny",
  "Action": [
    "iam:CreatePolicyVersion",
    "iam:SetDefaultPolicyVersion",
    "iam:AttachRolePolicy",
    "iam:PutRolePolicy",
    "iam:AttachUserPolicy",
    "iam:CreateAccessKey",
    "iam:UpdateAssumeRolePolicy",
    "iam:PassRole"
  ],
  "Resource": "*"
}

iam:PassRole is the classic one — the ability to hand a more powerful role to a service the agent can invoke. If the agent legitimately must pass a role, scope the Allow for iam:PassRole to that one role ARN with a Condition on iam:PassedToService, rather than leaving it in the deny.

No self-assumption chains

Keep the agent's trust relationships tight so it cannot assume a broader role. Combine an explicit deny (or a scoped sts:AssumeRole to specific role ARNs) with a permission boundary (see the tool-roles control), so identity policy AND boundary both cap the ceiling.

Naming note: replace the model and table ARNs. If the agent needs iam:PassRole, remove it from the deny and add a narrowly scoped allow instead — do not grant broad PassRole.