Exercise 2: Tracing Least Privilege Through the Full Architecture — Possible Solution
====================================================================

Least privilege appears at multiple real, distinct points in this
capstone's own architecture, not just once:

1. STEP 2 (web server IAM role): scoped to only s3:PutObject/
   s3:GetObject on the one specific application bucket, plus
   CloudWatch Logs access. If this were instead a broad role (e.g.
   full S3 access across the whole account), a compromised web server
   could read or modify data in every other bucket in the account,
   not just its own application bucket.

2. STEP 4 (web server security group): allows inbound HTTP only from
   the load balancer, not directly from the internet. Without this,
   the web servers would be directly reachable by anyone, bypassing
   the load balancer's own health-check-based traffic management
   entirely and exposing a larger real attack surface.

3. STEP 6 (RDS security group): allows inbound traffic only from the
   web tier's own security group, never a public IP or 0.0.0.0/0.
   Without this, the database could be reached directly from outside
   the VPC, or from any other resource in the account, rather than
   only from the specific application servers that legitimately need
   to query it.

4. STEP 7 (Lambda IAM role): scoped identically narrowly to Step 2 --
   read the original image, write the thumbnail, nothing more. A
   broader role here would mean a bug or vulnerability in the
   thumbnail-generation code could reach far more of the account's
   own resources than the function actually needs to touch.

ANSWER: Least privilege is applied at the web server's own IAM role
(Step 2), the web server's security group (Step 4), the RDS security
group (Step 6), and the Lambda function's own IAM role (Step 7). At
each point, failing to apply it would mean a single compromise (of
the web server, the database's own network exposure, or the Lambda
function) could reach far more of the account's resources than that
specific component actually needs -- a larger real blast radius at
every one of these four points.

WHY THIS WORKS AS AN ANSWER
------------------------------
This identifies every real, distinct point where the principle is
applied (not just the most obvious one) and explains the specific,
concrete consequence of removing it at each point -- directly
extending Chapter 2's own original least-privilege reasoning across
the full, multi-service architecture this capstone actually builds.