Tighten an over-broad cloud access policy

About this exercise

The reporting app's cloud policy grants far more than it needs. Rewrite it so it grants only what the app does today, per the notes. Your team's convention: one statement per line, and each statement gets a Sid from this list: ReadSalesExports, WriteFinanceReports, QuerySalesDb. Put the policy in exactly 1 code block of at most 12 lines, with under 20 words outside it.

Common mistakes when you ask AI for this

• Not giving what the app needs. The AI guesses permissions and often keeps broad ones 'for flexibility'. Try: Say: "Grant only the actions in the app notes, nothing else."
• Leaving a wildcard. The AI narrows some lines but keeps a * somewhere. Try: Add: "No wildcard actions and no iam permissions."
• Ignoring the team convention. The AI pretty-prints each statement over many lines and leaves out Sids. Try: Say: "One statement per line, with Sids ReadSalesExports, WriteFinanceReports, QuerySalesDb."
• A long explanation. The AI adds paragraphs on least privilege around the code. Try: Limit it: "One code block, one short sentence outside it."
• Keeping retired access. The AI keeps the archive bucket because it appears in the notes. Try: Add: "Only what the app does today. The archive job is retired."

What a strong prompt includes

• Grants only what's listed
• Bans wildcards
• Gives the team convention
• Asks for one code block
• Limits the explanation

Practice this now ↑

Related exercises

• Add dark mode by overriding your existing CSS variables (Coding AI · Software developers)
• Add input checks to your number guessing game (Coding AI · High school students)
• Add labels to a signup form without rewriting the page (Coding AI · High school students)
• Announce a territory change without promising comp outcomes (Sales AI · Revenue operations)
• Announce the employee assistance program in three steps (Writing AI · HR and recruiting)