Service accounts follow the principle of least privilege

PCI-DSS 4.0 Req 7.2.2 requires that privileges assigned to accounts and roles are based on least privilege. Req 8.2.1 limits account use to the single purpose for which it was created. A reporting cron job running with full database admin credentials means a compromised job scheduler has write access to the entire CDE. CWE-250 (Execution with Unnecessary Privileges) and OWASP A01 (Broken Access Control) both flag over-privileged service accounts as exploitable. NIST AC-6 (Least Privilege) mandates that each automated process is granted only the minimum rights required for its function.

Audit every service account, API key, and IAM role in your infrastructure and downscope each to the minimum required permissions. Create named database users per job rather than sharing an admin credential.

-- Read-only user for nightly reporting job
CREATE USER reporting_job PASSWORD 'generated_secret';
GRANT CONNECT ON DATABASE main TO reporting_job;
GRANT USAGE ON SCHEMA public TO reporting_job;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO reporting_job;

For AWS IAM, replace "Action": "*" with an explicit list of required actions and a specific resource ARN. For Stripe, create a Restricted Key in the dashboard scoped to only the operations each service needs — webhook handlers need webhooks:read, not full account access. Document each service account's scope in docs/rbac.md.