I infer from that, that not only do the developers have access to the production server, they apparently intend on developing on it. In addition to correct answer, regarding increased attack surface, possible exploits, and easier attack environment for a potential hacker, I wanted to point out one more issue that should be obvious, but is often painfully not. Policy-wise, not having development tools on a webserver is in my mind a good idea - it discourages developers from 'doing it live'. After all, all this talk of compiling abitrary code under unprivileged users actually misses the point: at that stage, somebody has already gained a foothold on your system and that is what you want to prevent. I personally see nothing wrong with installing the dev tools (I'd pull them in manually with yum install so they can be then yum remove'd later) and then removing them after their purpose is fulfilled. That said - chances are also high that you're running an interpreter such as python, or have javac around for web applications or some such - so the actual material impact might not be much different. The specific risk for development tools is that if an attacker gains access to an unprivileged user, chances are they can then use say gcc to compile arbitrary code on your box. programs and utilities that can be compromised or used as part of a compromise.

Why? To reduce the 'attack surface' available on the system - i.e. Perhaps we should modify that to: if you no longer need it, uninstall it. The general rule for systems is: if you don't need it, don't install it.

Ec2 linux imagemagick