Match access to the purpose
Start from the approved evidence and action scope. Prefer provider-supported roles, delegated access, or short-lived credentials that can be reviewed and revoked. Use read-only access when collection and assessment do not require a change.
Data collection and response need different permissions. Do not grant permission to change systems when a connection only needs to read data.
Access checklist
- Use a dedicated connection identity rather than a person's daily account where the provider supports it.
- Limit resource scope, actions, regions, and duration to the approved need.
- Keep secrets in the approved protected channel and never paste them into support tickets or public documentation.
- Enable provider audit records and record the connection owner.
- Set a review and revocation date before access is granted.
Review after change and remove when finished
Recheck access after a provider migration, scope expansion, failed connection, role change, or new response requirement. Revoke evaluation access when the evaluation ends and remove access promptly when a connection is retired.