IAM and least privilege

IAM is where a small infra team either contains a compromise to one pod or hands an attacker the whole account. On a flat, talent-dense team, you own that boundary directly.

The design-round version of this question is rarely "what is an IAM role." It is "a credential leaks or a pod is compromised - how far does the damage spread and how did your design limit it?" Answer in terms of blast radiusHow much breaks if a change goes wrong; the scope of potential damage. Press Enter for the full definition. and least privilege and ground it in how workloads actually get credentials on EKS.