Your deploy role has full administrator access because narrowing it kept breaking things. How do you fix that properly?
What they are really testing: Whether you can narrow permissions methodically rather than by trial and error. The honest admission in the question is common, and the method for fixing it separates people who have actually done it.
A real interview question
Your deploy role has full administrator access because narrowing it kept breaking things. How do you fix that properly?
What most people say
drag me
“I would remove the admin policy and add permissions back whenever a deploy fails.”
That is exactly the process that failed the first time. Learning permissions by breaking production deploys is slow, stressful and gets abandoned, which is how the admin grant became permanent in the first place.
The follow-ups they ask next
Ninety days of logs might not include an annual disaster recovery action. How do you handle that?
Accept that log-derived policies cover the common path, and treat rare operations as an explicit break-glass role that is separately assumable, heavily logged, and alerted on use.
What is the risk of a read-only plan role in Terraform specifically?
Plan can still read secrets into state and output, so read-only is not risk-free. The state backend and any plan artifacts need protecting, and plan output posted to a pull request can leak sensitive values.
How do you keep it narrow over time as the system grows?
Periodic access review comparing granted against used permissions, plus policy as code in the same repository so an added permission is a reviewed diff rather than a console click.
What the interviewer is listening for
- Derives policy from actual usage data
- Splits plan and apply roles
- Alerts on denials to make narrowing a feedback loop
- Plans for rare operations explicitly
What sinks the answer
- Trial and error against production
- One role for everything
- No monitoring of denials
- Treats admin as acceptable indefinitely
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“It is admin because [guessing permissions means breaking deploys, so people give up]. Instead [derive the policy from 90 days of actual API call logs], [test it in a dev account first], [split read-only plan from write apply], and [alert on access denied events so narrowing becomes a feedback loop rather than a gamble].”
Keep going with security
Junior
Your pipeline needs credentials to deploy to production. How do you handle that safely?
Mid
Your vulnerability scanner reports 200 CVEs in a production image. How do you handle it?
Mid
How would you rotate a database password used by 12 running services with no downtime?
Senior
Compliance requires that every production change is approved and auditable. How do you keep deploying daily?
Senior
How would you protect your build pipeline from a supply chain attack?
Mid
Our pipeline takes 45 minutes and developers have stopped waiting for it. How do you fix that?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free