learn-iam-policy

Labs helping you to learn how write IAM policies following the least privilege principle.

Introduction

We are using <Variable> to indicate that you should replace parts of the instructions with a variable.

Preparing the lab environment

The CloudFormation template lab-environment.yml creates a lab environment consisting of:

• EC2 Instance with an IAM role attached (access to SSM is granted for Session Manager access)
• S3 bucket
• SSM parameters

1. Create a CloudFormation stack based on the template lab-environment.yml.
   1. Set stack name to your name but only use characters a-z (lowercase!).
2. Make a note with the outputs of the stack: IamRole, S3Bucket.
3. Connect to the EC2 instance using SSM Session Manager
   1. Visit https://console.aws.amazon.com/systems-manager/session-manager/start-session
   2. Select your instance
   3. Push the Start Session button
   4. Jump to your home directory: cd ~
4. Done. You can now start with the labs.

Labs

• Lab 01: S3 read access
• Lab 02: S3 read and write with prefix
• Lab 03: Parameter Store read access
• Lab 04: Grant access to KMS customer managed CMK
• Lab 05: Terminate EC2 instance with tag
• Lab 06: Launch EC2 instance with tag

Clean up

1. Empty your S3 bucket <S3Bucket>.
2. Delete your CloudFormation stack.