Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The safest pattern is to give each AI agent its own IAM role, start that role with no permissions, and add only the API actions and resource ARNs its defined tasks require. Issue the role through AWS STS for temporary credentials, narrow individual sessions with session policies, and place independent ceilings around the role with a permissions boundary and (where applicable) an Organizations SCP. IAM conditions can restrict requests by region, tags, time, or network context. CloudTrail activity and IAM Access Analyzer then show what the agent actually used so you can remove unused access without guessing.
Keep three identities separate: the person or application that starts the work, the agent workload role that performs it, and any service role used by a managed agent platform such as Amazon Bedrock Agents. Separation keeps audit records intelligible and prevents an agent from inheriting a human operator’s entire permission set.
Start with an identity model that separates responsibilities
An IAM role is an AWS identity with a permission policy. When a trusted principal assumes it, AWS Security Token Service (STS) returns temporary access key credentials. The role’s policy describes what those credentials can do; the trust policy describes who or what may assume the role.
| Identity | Purpose | What to avoid |
|---|---|---|
| Human operator | Signs in through federation, preferably IAM Identity Center, and requests or starts an agent task. | Giving the agent the person’s long-lived credentials or full human role. |
| Agent workload role | Performs the API calls required by one agent or tightly bounded workload, using temporary credentials. | Sharing one broad role across unrelated agents or granting administrator-style wildcards for convenience. |
| Managed-agent service role | Lets a service such as Bedrock Agents access configured models, schemas, knowledge bases, or other enabled features. | Assuming that the platform’s service role and your workload role are interchangeable. |
| Downstream resource policy | Controls resource-based access, such as a Lambda function that an action group must invoke. | Configuring only the caller’s identity policy and forgetting the resource policy. |
AWS’s Agentic AI Lens describes three useful control layers: broad capability limits at the service-identity layer, per-operation limits at the transaction layer, and user-context limits at the user-identity layer. Use all three when an agent acts for a person. Pass verifiable user context to the downstream application or resource so it can enforce that person’s authorization; do not simply let the agent assume the user’s complete role for the duration of a session.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Define the smallest task boundary before writing a policy
Write down what the agent is allowed to accomplish, not just which service it uses. A document summarizer might need to read objects from one prefix and write a result to another. It should not receive every S3 action, every bucket, or unrelated DynamoDB and IAM permissions.
Build an action-and-resource inventory
- List each workflow operation in plain language, such as “read an input object,” “write a generated report,” or “invoke this action function.”
- Map each operation to the narrowest AWS API action. Prefer read actions over write actions, and one write action over a service-wide write wildcard.
- Record the exact resource ARN for every action that supports resource-level permissions. Separate bucket-level and object-level ARNs where the service requires both.
- Mark actions that do not support resource scoping and compensate with conditions, a separate account, or a different design.
- Identify exceptional operations, such as deleting data or changing an IAM policy. Keep them out of the normal role and handle them through a separately approved, just-in-time path.
| Task | Typical permission shape | Scope decision |
|---|---|---|
| Read input files | s3:GetObject |
Objects under the agent’s input prefix only. |
| List that prefix | s3:ListBucket |
The single bucket, with a prefix condition where supported. |
| Write results | s3:PutObject |
A separate results prefix; omit delete and ACL-changing actions. |
| Call a specific function | lambda:InvokeFunction |
One qualified function ARN, with a matching resource-based policy. |
AWS recommends beginning an agent role with no permissions and adding only what the defined task requires. This is more reliable than attaching a broad managed policy and trying to discover exclusions later.
Create a dedicated workload role
1. Configure a narrow trust policy
In the IAM console, open Roles, choose Create role, and select the documented AWS service or workload principal that will run the agent. For an application outside AWS, use its federated or identity-provider trust mechanism. Restrict who can assume the role, and add external-ID or source constraints when the integration supports them. Do not add human administrators to the trust policy merely because they need to troubleshoot; give them a separate administrative path.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →2. Attach a task-specific permissions policy
Start with an inline or customer-managed policy containing only the actions and ARNs in your inventory. This illustrative policy lets an agent read objects from one input bucket and write objects to one results bucket:
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ReadAgentInputs",
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::agent-task-inputs/*"
},
{
"Sid": "ListAgentPrefix",
"Effect": "Allow",
"Action": ["s3:ListBucket"],
"Resource": "arn:aws:s3:::agent-task-inputs",
"Condition": {
"StringLike": {
"s3:prefix": ["incoming/*"]
}
}
},
{
"Sid": "WriteAgentResults",
"Effect": "Allow",
"Action": ["s3:PutObject"],
"Resource": "arn:aws:s3:::agent-task-results/*"
}
]
}The bucket names above are an example of narrow resource naming, not a permission to use every bucket in the account. Adapt the ARNs and prefix condition to your deployment. If the agent never needs to delete, copy, change encryption, or change a bucket policy, those actions should not appear in its policy.
3. Test the role as the agent, not as an administrator
Assume the role with the same principal and external conditions used in production. Test every intended success path and an explicit negative path: reading an unrelated bucket, deleting an input, changing an IAM policy, and invoking an unrelated function should fail. An administrator’s successful test proves only that the administrator is authorized; it does not prove that the agent role is correctly scoped.
Use STS credentials and narrow each session
Have the runtime call STS to obtain temporary credentials rather than storing an IAM user’s access key. Set a short session duration appropriate to the task. AWS’s Agentic AI Lens recommends 15-to-60-minute sessions for agent credential issuance. That is AWS guidance, not a universal mandate; choose the shortest period that lets a normal transaction finish and renew only through an authorized workflow.
Apply a session policy for transaction-level narrowing
When the same role serves several tightly related operations, pass a session policy to AssumeRole for each transaction. For example, a role might generally allow read and write access, while a read-only run receives a session policy that allows only the input bucket:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:ListBucket"],
"Resource": [
"arn:aws:s3:::agent-task-inputs",
"arn:aws:s3:::agent-task-inputs/*"
]
}
]
}Pass that document with the AWS CLI’s --policy option when calling sts assume-role, or use the equivalent SDK parameter. The effective permissions are the intersection of the role’s identity policy and the session policy. AWS states: “You cannot use session policies to grant more permissions than those allowed by the identity-based policy of the role that is being assumed.” A session policy can remove s3:DeleteObject from a session even when the role allows it; it cannot add a permission absent from the role.
Record the transaction identifier, intended user context, role session name, and expiration time so investigators can connect an API call to one agent run. Never treat a session policy as a replacement for a carefully scoped role: a caller that omits the session policy may otherwise receive the role’s full allowed set.
Add independent ceilings and request conditions
Layered controls limit the damage from a mistaken policy edit or a compromised runtime. They complement, rather than replace, the role’s least-privilege policy.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Control | What it limits | How to use it for an agent |
|---|---|---|
| Role identity policy | Actions and resources the role may use. | Grant the exact task permissions; start from an empty policy. |
| STS session policy | The subset available in one assumed-role session. | Generate per-transaction read-only or single-resource sessions. |
| Permissions boundary | The maximum an identity-based policy can grant to the role. | Attach an approved ceiling so later policy changes cannot exceed the organization’s agent envelope. |
| Service Control Policy (SCP) | The maximum permissions for principals in an AWS Organizations account or organizational unit. | Deny categories that must remain unavailable to agents across accounts, such as IAM administration or disabling logging. |
| IAM conditions | When, where, or under which attributes an allowed action may run. | Constrain region, tags, time window, source VPC, or other keys supported by the API. |
| Downstream user context | What the originating person is allowed to do. | Pass verifiable identity context to the application or resource instead of granting the agent the person’s whole role. |
Permission boundaries and SCPs are ceilings, not grants
A permissions boundary does not authorize an action by itself. The role’s identity policy must still allow the action, and the boundary must also permit it. An SCP similarly sets an account-level maximum; it does not supply the role’s task permissions. Evaluate all applicable policy types together, including resource-based policies and explicit denies, for the particular service and principal.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Use conditions only where the service supports them
Conditions are useful when a resource ARN alone cannot express the policy. Examples recommended in AWS’s Agentic AI Lens include aws:RequestedRegion, resource-tag keys, aws:CurrentTime, and aws:SourceVpc. Confirm that the target API supplies the key and that the value is meaningful for the request type.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["ec2:DescribeInstances"],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:RequestedRegion": "us-east-1"
}
}
},
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::agent-task-inputs/*",
"Condition": {
"StringEquals": {
"aws:ResourceTag/Environment": "agent"
}
}
}
]
}For time-boxed maintenance, combine DateGreaterThan and DateLessThan conditions on aws:CurrentTime. For private workloads, an aws:SourceVpc condition can be appropriate when the service exposes that context. A condition that is unsupported, evaluated differently by a service, or attached to an action with a wildcard resource can create either a false sense of security or an unexpected deny, so test it with the exact call path.
Configure Amazon Bedrock Agents without over-granting
Bedrock Agents introduces two separate authorization jobs. The agent’s service role needs permission to use the features enabled in its configuration, and each action-group Lambda function needs a resource-based permission that allows the service role to invoke it.
Scope the Bedrock service role to enabled features
- Create or select a service role whose trust policy allows the Bedrock Agents service to assume it.
- Grant only the model access and supporting resources used by this agent. A common configuration may need model invocation, S3 objects containing action-group OpenAPI schemas, and attached knowledge bases.
- Add optional permissions only when the configuration uses them: collaborators, provisioned throughput, guardrails, code interpretation, or KMS decryption each introduce a different access requirement.
- Use operation-specific permissions instead of attaching a broad convenience policy such as full Bedrock access when a narrower identity-based example covers the enabled operations.
- After changing an agent’s features, retest both the service role and every action group; remove permissions for features that were disabled.
The exact feature list changes with the agent configuration and account setup. Treat the current Bedrock Agents identity documentation as the authority for the trust relationship, actions, and resource types required by your enabled features.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Authorize the action-group Lambda separately
Identity permissions on the Bedrock service role are not enough when Lambda’s resource-based policy does not allow invocation. Add a Lambda resource policy statement that permits the Bedrock service role to invoke the specific action-group function, and constrain the statement to the relevant function and source context where the service supports it. Test an actual action-group call and inspect both the Bedrock response and the Lambda invocation log. A failure at this boundary commonly appears as an agent tool error even though the role policy looks correct.
Observe real activity and refine without guessing
Use CloudTrail as the behavioral baseline
Run representative agent tasks, including successful and intentionally denied operations, then inspect CloudTrail for the role session. Record the API action, resource, region, error code, source context, and session name. Distinguish a call required for a real workflow from an SDK discovery call that can be eliminated or constrained.
Generate a starting policy with IAM Access Analyzer
IAM Access Analyzer can use CloudTrail-observed activity to suggest a policy. Treat the generated document as a starting point, not an approval. Review every action and resource, replace broad ARNs with the exact resource where possible, check whether a call was produced only by a test or deployment step, and add conditions that reflect the intended boundary. Then rerun the workflow and verify that the tightened policy still permits the required path.
Free tools Windows power users keep installed
One-click scans. No signup required.
Review for access drift
- Compare current policies with the task inventory and remove actions no longer used.
- Look for new resources, regions, models, action groups, or data stores added by configuration changes.
- Check that the permissions boundary and SCP still cover the role after account or organizational changes.
- Inspect role-session names and CloudTrail events for unexpected callers or unusually long sessions.
- Repeat negative tests after every policy, agent, network, or feature change.
Troubleshoot the failures that least-privilege designs expose
| Symptom | Likely cause | What to check |
|---|---|---|
AccessDenied for an intended call |
The action or ARN is absent, a resource ARN is the wrong level, or a condition does not match. | Inspect the CloudTrail event, verify the exact API action and resource type, and test the condition values. |
| The role policy allows a call but the session cannot make it | A session policy narrowed the intersection. | Inspect the policy passed to STS and remember that it cannot elevate the role. |
| A policy edit appears to have no effect | A permissions boundary or SCP is denying the new grant. | Evaluate the boundary and organizational policies along with the identity policy; check for explicit denies. |
| Bedrock cannot run an action group | The service role lacks an enabled-feature permission, or Lambda’s resource policy does not allow invocation. | Check the Bedrock service-role policy, trust policy, Lambda resource policy, function ARN, and invocation logs. |
| Calls fail only in some regions or networks | A region or source condition is working as designed, or the service does not provide the expected context key. | Compare the denied event’s context with the condition and confirm support for that key on the specific action. |
| Auditors cannot identify who initiated a change | The agent reused a human role or sessions have indistinguishable names. | Use a dedicated workload role, meaningful role-session names, and verifiable user context passed to the downstream system. |
Production checklist
- One role represents one agent or a tightly bounded workload.
- The trust policy names only the runtime or federation path that must assume it.
- The identity policy began empty and now contains only task-required actions and resource ARNs.
- Delete, IAM administration, logging changes, and other exceptional powers are absent from the normal role.
- STS supplies temporary credentials, with a session lifetime appropriate to the transaction; AWS guidance suggests 15 to 60 minutes for agent credential issuance.
- Session policies narrow high-risk or read-only transactions and are not treated as a way to add permissions.
- A permissions boundary caps role grants, and an SCP blocks organization-wide categories that agents must never use.
- Conditions restrict region, tags, time, or source VPC only where the target service supports and evaluates them as expected.
- Human authorization is represented as downstream user context, not by handing the agent the human’s full role.
- Bedrock service-role permissions match enabled features, and every action-group Lambda has the required resource-based invocation permission.
- CloudTrail observations and IAM Access Analyzer suggestions have been reviewed by a person, then validated with positive and negative tests.
- Policies and access are revisited whenever the agent’s tools, data, account boundaries, or behavior changes.
Least privilege is therefore a feedback loop: define one task, grant its smallest role, narrow each session, enforce independent ceilings and context, observe actual calls, and remove anything the workload cannot justify.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
