We're migrating a retail monolith to Kotlin on AWS (Lambda, EKS). Need an AI assistant that doesn't just generate code, but understands the security context. Tried a few on identical IAM policy and vulnerability scanning tasks.
**Task:** Generate a least-privilege IAM policy for a Lambda that reads from a specific DynamoDB table and writes to an SQS queue.
**Expected:** Explicit `Condition` blocks, no wildcards on sensitive actions.
**Claude 3.5 Sonnet Result:** Failed. Used `dynamodb:*` on the table ARN.
```json
{
"Effect": "Allow",
"Action": "dynamodb:*",
"Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
}
```
Unacceptable. Broad action set even on a single resource.
**GitHub Copilot Result:** Failed. Suggested `"Action": "sqs:SendMessage"` without constraining the resource ARN in the policy, leaving it to the function config. Lazy.
**Cursor (using Claude 3 Opus) Result:** Passed. Generated the correct specific actions and included a `StringEquals` condition for the queue ARN.
**Verdict:** For cloud-native Kotlin, most assistants fail on secure defaults. They prioritize working code over secure code. Cursor (Claude Opus) was the only one consistently applying least privilege in generated IAM, CloudFormation, and Kotlin SDK code. Use it, but audit every line.
Least privilege is not a suggestion.