The 2019 Capital One breach chained a server-side request forgery to an over-permissive IAM role. Walk the chain, and say which single control would have contained it.

The chain, as publicly reported

1. A misconfigured web application firewall permitted server-side request forgery — the application could be induced to make an HTTP request to an attacker-chosen address.
2. That was pointed at the EC2 instance metadata service at 169.254.169.254, which in the version then in use (IMDSv1) returned credentials to any process that asked, with no authentication.
3. The returned credentials belonged to the instance's IAM role, which had permissions to list and read S3 buckets far beyond what the application needed.
4. Those permissions were used to enumerate and copy bucket contents — roughly 100 million US and 6 million Canadian customer records.

Capital One was subsequently fined \(80M by the OCC and settled a class action for \)190M.

Which control contains it

Each link is individually breakable, and the honest answer names the one with the best ratio of containment to effort:

Least privilege on the IAM role. SSRF is a bug class that will recur; instance credentials exist by design. What turned an application vulnerability into a 100-million-record breach was that the credentials it exposed could read data the application had no business reading.

A role scoped to the specific buckets and prefixes the workload uses turns step 4 into an AccessDenied — and an alarm.

The other controls, and why they matter too

IMDSv2 (session-oriented, requires a PUT to obtain a token, and defaults to a hop limit that blocks proxied requests) breaks step 2 structurally. It is now the recommended default and should be enforced organisation-wide, not per-instance.

Egress filtering breaks step 1's usefulness: an application that cannot make arbitrary outbound requests cannot be turned into a proxy. Outbound restriction is the control teams most often skip.

Detection on anomalous data access. Enumerating and reading many buckets is a distinctive pattern; the breach reportedly went undetected until an external party reported it.

Encryption with a separate key policy, so that read access to an object is not automatically read access to its contents.

The general lesson

In cloud, IAM is the blast-radius boundary — not the network. The attacker never needed to move laterally through a network; they needed one set of credentials with more scope than the workload required. Every over-broad role is a pre-positioned escalation path waiting for any application bug at all.

What a strong answer adds

Naming the review practice: cloud providers now report which granted permissions have never been exercised. That turns least privilege from an argument into a report, and makes "this role has 40 permissions and has used 6" an actionable finding rather than a philosophical one.