Lesson 1.13: IAM and least privilege
In the cloud, identity is the perimeter: whoever holds the right credentials can do whatever their policies allow, from anywhere. IAM policies are JSON documents listing allowed actions on resources, and the most dangerous one is two asterisks: every action on every resource. In the lab you list which policy each Northwind identity has, read AdministratorAccess and a properly scoped custom policy side by side, find a dormant former intern who is still an administrator, and move the CI pipeline from full admin to the deploy policy it actually needs.
17 min
You will learn to
- Explain identities, policies and roles
- Read an IAM policy document
- Recognise wildcard (admin) permissions
- Find dormant privileged identities
- Apply least privilege by replacing a policy
Key terms
- IAM
- Identity and Access Management: the users, groups, roles and policies that control access in a cloud account.
- Policy
- A JSON document of statements: Effect (Allow/Deny), Action, Resource, optional Condition.
- Role
- An identity without permanent credentials, assumed for a session by people, services or workloads.
- ARN
- Amazon Resource Name: the unique identifier of an AWS resource.
- Least privilege
- Granting only the actions and resources a task needs.
← Where the logs live · All lessons · Classical ciphers and Kerckhoffs's principle →