Challengeaws
AWS IAM & Least Privilege — Challenge
Write a policy that grants exactly one action, prove what it blocks, and swap a long-lived key for a role.
- Time
- 25 min
- Level
- Beginner
- Objectives
- 4 objectives
- Cost
- Free
Before you start
You will need
- AWS CLI v2, configured
- An AWS account
You will be able to
- Read and write an IAM policy document
- Test a permission before shipping it, with the policy simulator
- Explain the difference between a trust policy and a permissions policy
You are done when
0 of 4
The goal#
Achieve the same outcome as AWS IAM & Least Privilege, from an empty starting point, without the steps.
The application has an access key with AdministratorAccess because that made it work. Everybody knows it is wrong; nobody knows what it actually needs.
This lab replaces it with a policy you can defend, and a role instead of a key.
What must be true when you are done#
- A user can read one specific S3 bucket and nothing else, proven by an allowed call and a denied one.
- You can explain why
s3:ListBucketands3:GetObjectneed different resource ARNs. - A role is assumed with
sts assume-role, returning credentials that expire. - You can name what an explicit
Denydoes to anAllow.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
The concept behind it
Next up
Lab 14 of 58 on the project path