diff --git a/.github/workflows/closed-issues-message.yml b/.github/workflows/closed-issues-message.yml
index 2ba272de74..dafafb698d 100644
--- a/.github/workflows/closed-issues-message.yml
+++ b/.github/workflows/closed-issues-message.yml
@@ -2,9 +2,15 @@ name: Closed Issue Message
 on:
   issues:
     types: [closed]
+
+permissions:
+  contents: read
+
 jobs:
   auto_comment:
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
       - uses: aws-actions/closed-issue-message@36b7048ea77bb834d16e7a7c5b5471ac767a4ca1 # v1.0.0
         with:
diff --git a/.github/workflows/label_pr_on_title.yml b/.github/workflows/label_pr_on_title.yml
index f803c0c6a2..d8535a599a 100644
--- a/.github/workflows/label_pr_on_title.yml
+++ b/.github/workflows/label_pr_on_title.yml
@@ -6,6 +6,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   get_pr_details:
     # Guardrails to only ever run if PR recording workflow was indeed
@@ -18,6 +21,8 @@ jobs:
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}
   label_pr:
+    permissions:
+      pull-requests: write
     needs: get_pr_details
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/make-release.yml b/.github/workflows/make-release.yml
index 122e3844da..11bf20f0b1 100644
--- a/.github/workflows/make-release.yml
+++ b/.github/workflows/make-release.yml
@@ -1,6 +1,10 @@
 name: Make Release
 on:
   workflow_dispatch: {}
+
+permissions:
+  contents: read
+
 concurrency:
   group: on-release-publish
 jobs:
diff --git a/.github/workflows/make-v2-release.yml b/.github/workflows/make-v2-release.yml
index 0c20a1686a..acca549caa 100644
--- a/.github/workflows/make-v2-release.yml
+++ b/.github/workflows/make-v2-release.yml
@@ -1,6 +1,10 @@
 name: Make Release v2 (pre-release)
 on:
   workflow_dispatch: {}
+
+permissions:
+  contents: read
+
 concurrency:
   group: on-release-publish
 jobs:
diff --git a/.github/workflows/measure-packages-size.yml b/.github/workflows/measure-packages-size.yml
index ff52dfeaca..3827f6c60e 100644
--- a/.github/workflows/measure-packages-size.yml
+++ b/.github/workflows/measure-packages-size.yml
@@ -7,8 +7,13 @@ on:
         description: "PR Number"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   measure-utils-sizes:
+    permissions:
+        pull-requests: write
     runs-on: ubuntu-latest
     env:
       NODE_ENV: dev
diff --git a/.github/workflows/on-doc-v2-merge.yml b/.github/workflows/on-doc-v2-merge.yml
index 4733c3dba5..cb552d880e 100644
--- a/.github/workflows/on-doc-v2-merge.yml
+++ b/.github/workflows/on-doc-v2-merge.yml
@@ -8,6 +8,9 @@ on:
       - "docs/**"
       - "mkdocs.yml"
 
+permissions:
+  contents: read
+  
 jobs:
   release-docs:
     permissions:
diff --git a/.github/workflows/on-merge-to-main.yml b/.github/workflows/on-merge-to-main.yml
index 7995d385d1..e32eddef02 100644
--- a/.github/workflows/on-merge-to-main.yml
+++ b/.github/workflows/on-merge-to-main.yml
@@ -5,12 +5,18 @@ on:
     workflows: ["Record PR details"]
     types:
       - completed
+
 concurrency:
   group: on-merge-to-main
 
+permissions:
+  contents: read
+
 jobs:
   get_pr_details:
     if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion == 'success'
+    permissions:
+      pull-requests: read
     uses: ./.github/workflows/reusable_export_pr_details.yml
     with:
       record_pr_workflow_id: ${{ github.event.workflow_run.id }}
@@ -22,6 +28,8 @@ jobs:
     if: ${{ needs.get_pr_details.outputs.prIsMerged == 'true' }}
     uses: ./.github/workflows/reusable-run-linting-check-and-unit-tests.yml
   update-release-draft:
+    permissions:
+      contents: write
     needs: run-unit-tests
     runs-on: ubuntu-latest
     steps:
@@ -32,6 +40,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   release_label_on_merge:
+    permissions:
+      pull-requests: read
+      contents: write
     needs: [get_pr_details, update-release-draft]
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/on-workflows-push-pr.yml b/.github/workflows/on-workflows-push-pr.yml
index d8642f5715..cc5d45e1b5 100644
--- a/.github/workflows/on-workflows-push-pr.yml
+++ b/.github/workflows/on-workflows-push-pr.yml
@@ -8,10 +8,15 @@ on:
     paths:
       - ".github/workflows/**"
 
+permissions:
+  contents: read
+
 jobs:
   enforce_pinned_workflows:
     name: Harden Security
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     steps:
       - name: Checkout code
         uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab  # v3.5.2
diff --git a/.github/workflows/on_doc_merge.yml b/.github/workflows/on_doc_merge.yml
index 2cea171dc8..13f374945e 100644
--- a/.github/workflows/on_doc_merge.yml
+++ b/.github/workflows/on_doc_merge.yml
@@ -8,6 +8,9 @@ on:
       - "docs/**"
       - "mkdocs.yml"
 
+permissions:
+  contents: read
+
 jobs:
   release-docs:
     permissions:
diff --git a/.github/workflows/on_opened_pr.yml b/.github/workflows/on_opened_pr.yml
index 0c0b9c62b4..717b9f5acf 100644
--- a/.github/workflows/on_opened_pr.yml
+++ b/.github/workflows/on_opened_pr.yml
@@ -6,6 +6,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   get_pr_details:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
@@ -16,6 +19,9 @@ jobs:
     secrets:
       token: ${{ secrets.GITHUB_TOKEN }}
   check_related_issue:
+    permissions:
+      issues: read
+      pull-requests: write
     needs: get_pr_details
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index 8bcceb4573..398f84a499 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -12,6 +12,9 @@ on:
   release:
     types: [released]
 
+permissions:
+  contents: read
+
 jobs:
   post_release:
     permissions:
diff --git a/.github/workflows/pr-run-linting-check-and-unit-tests.yml b/.github/workflows/pr-run-linting-check-and-unit-tests.yml
index 9b76b199f5..2f8da3bb36 100644
--- a/.github/workflows/pr-run-linting-check-and-unit-tests.yml
+++ b/.github/workflows/pr-run-linting-check-and-unit-tests.yml
@@ -3,6 +3,10 @@ name: On PR code update
 on:
   pull_request:
     types: [opened, synchronize]
+
+permissions:
+  contents: read
+
 jobs:
   run-unit-tests:
     uses: ./.github/workflows/reusable-run-linting-check-and-unit-tests.yml
\ No newline at end of file
diff --git a/.github/workflows/rebuild-latest-docs.yml b/.github/workflows/rebuild-latest-docs.yml
index 5d6ad78d30..a60edd953f 100644
--- a/.github/workflows/rebuild-latest-docs.yml
+++ b/.github/workflows/rebuild-latest-docs.yml
@@ -13,6 +13,9 @@ on:
         description: "Latest npm published version to rebuild latest docs for, e.g. 1.6.0"
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   release-docs:
     permissions:
diff --git a/.github/workflows/record_pr.yml b/.github/workflows/record_pr.yml
index 882c54e6ed..118c01d82a 100644
--- a/.github/workflows/record_pr.yml
+++ b/.github/workflows/record_pr.yml
@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, edited, closed]
 
+permissions:
+  contents: read
+
 jobs:
   record_pr:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/reusable-run-linting-check-and-unit-tests.yml b/.github/workflows/reusable-run-linting-check-and-unit-tests.yml
index 9009f542cf..341bfe3fc3 100644
--- a/.github/workflows/reusable-run-linting-check-and-unit-tests.yml
+++ b/.github/workflows/reusable-run-linting-check-and-unit-tests.yml
@@ -3,6 +3,9 @@ name: Run unit tests
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   run-linting-check-and-unit-tests-on-utilities:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/reusable_deploy_layer_stack.yml b/.github/workflows/reusable_deploy_layer_stack.yml
index babf9cb2da..28bdd3d777 100644
--- a/.github/workflows/reusable_deploy_layer_stack.yml
+++ b/.github/workflows/reusable_deploy_layer_stack.yml
@@ -1,9 +1,5 @@
 name: Deploy cdk stack
 
-permissions:
-  id-token: write
-  contents: read
-
 on:
   workflow_call:
     inputs:
@@ -23,9 +19,13 @@ on:
       target-account-role:
         required: true
 
+permissions:
+  contents: read
 
 jobs:
   deploy-cdk-stack:
+    permissions:
+      id-token: write
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
diff --git a/.github/workflows/reusable_export_pr_details.yml b/.github/workflows/reusable_export_pr_details.yml
index 8695b522f2..5189c4beb3 100644
--- a/.github/workflows/reusable_export_pr_details.yml
+++ b/.github/workflows/reusable_export_pr_details.yml
@@ -33,10 +33,15 @@ on:
         description: "Whether PR is merged"
         value: ${{ jobs.export_pr_details.outputs.prIsMerged }}
 
+permissions:
+  contents: read
+
 jobs:
   export_pr_details:
     # see https://github.com/aws-powertools/powertools-lambda-python/issues/1349
     if: inputs.workflow_origin == 'aws-powertools/powertools-lambda-typescript'
+    permissions:
+      pull-requests: read
     runs-on: ubuntu-latest
     env:
       FILENAME: pr.txt
diff --git a/.github/workflows/run-e2e-tests.yml b/.github/workflows/run-e2e-tests.yml
index 4c2a2b6d55..e5d64e27bd 100644
--- a/.github/workflows/run-e2e-tests.yml
+++ b/.github/workflows/run-e2e-tests.yml
@@ -8,6 +8,9 @@ on:
         required: false
         default: ''
 
+permissions:
+  contents: read
+
 jobs:
   run-e2e-tests-on-utils:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/stale-issues.yml b/.github/workflows/stale-issues.yml
index 9e1ad6fca4..4086e0ccf2 100644
--- a/.github/workflows/stale-issues.yml
+++ b/.github/workflows/stale-issues.yml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: "0 0 * * *"
 
+permissions:
+  contents: read
+
 jobs:
   check-issues:
     runs-on: ubuntu-latest