Cloud › Module 3 › Lesson 3
Keys and Roles
Keys and roles literacy contrasts long-lived access keys with temporary role credentials — rotation and STS habits on YOUR $CLOUD_LAB.
Visual · t31_keys_and_roles
Keys and roles literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
Keys leak; roles expire — literacy names credential types so you harden sandboxes and read GuardDuty findings, not paste keys in chat.
Long-lived access keys in repos and CI logs are a top cloud incident source. IAM roles deliver temporary credentials via STS AssumeRole — preferred for EC2 instance profiles, Lambda, and human SSO federated access. Key hygiene: no root keys, rotate or delete unused keys, never commit to git, use role chaining only with documented trust. Cyberlium writes keys-vs-roles decision card on YOUR $CLOUD_LAB — inventory lab keys on paper, plan role replacement. Next: IAM Lab.
1. Credential types (named)
Access key + secret: long-lived — high risk in repos. Role session: temporary via STS — expires automatically. Instance profile: role attached to EC2/Lambda in your account. Federated user: SSO into role — no static key for humans.
On $CLOUD_LAB, list which lab workloads should use roles vs keys — prefer roles for all fictional apps.
Command guide
Try these commands — Credential types (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IAM roles — https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html STS — https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html Access keys hygiene — https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install awscli # or official AWS CLI v2
macOS:
Command — copy this
brew install awscli
Windows: Install AWS CLI v2 from Amazon
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
cat > "$CLOUD_LAB/aws/keys-and-roles-notes.txt" <<'EOF'
Keys vs Roles (YOUR account literacy):
Access keys: static creds — rotate, never commit, prefer roles
IAM roles: temporary creds via sts:AssumeRole — EC2/Lambda/EKS pattern
Instance profile: attaches role to EC2
Service-linked roles: AWS-managed for service integration
HARD BAN: use leaked keys against accounts you don't own
EOFYOUR ACCOUNT — verify caller identity before any IAM review
Command — copy this
aws sts get-caller-identity 2>/dev/null || echo 'Configure aws CLI for YOUR account first' grep -E 'roles|HARD BAN|YOUR ACCOUNT' "$CLOUD_LAB/aws/keys-and-roles-notes.txt"
Primary tools to practice this lesson: grep, aws. Reference sites: IAM roles (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html); STS (https://docs.aws.amazon.com/STS/latest/APIReference/welcome.html); Access keys hygiene (https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why roles beat keys for most workloads
Temporary credentials limit exposure window — stolen session token expires. GuardDuty flags key exfil patterns — defenders rotate and scope. CI/CD should assume OIDC role, not store static keys.
Students audit key inventory on personal sandbox console — delete unused lab keys.
3. Ethics: no key sharing
Forbidden: posting lab keys in Discord, reusing leaked keys on stranger accounts. Allowed: keys vs roles card — inventory, rotation plan, role target for $CLOUD_LAB fictional workload.
Ship: keys and roles card for YOUR sandbox. Next: IAM Lab.
4. What you ship: keys and roles card for $CLOUD_LAB
Key inventory, rotation plan, role replacement target. $CLOUD_LAB named. NO key sharing. chmod 600.
5. What you record before the next lesson
Date. Keys and roles card. $CLOUD_LAB named. File t31-m03-l03-keys-and-roles.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Commit access key to git 'for lab.' Share root keys in class chat.
Right
Write keys and roles card for YOUR $CLOUD_LAB. Next: IAM Lab.
Mission: plan role replacement on YOUR lab
1) Inventory any lab access keys on paper. 2) Mark delete or rotate dates. 3) Name STS role for fictional app. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If a key touched git, rotate — even on sandbox.
Knowledge Check
APPLY: Preferred credential for EC2 app in your account:
Multiple choice
Knowledge Check
APPLY: True or False: Long-lived access keys in repos are a common cloud incident source.
True or False
Knowledge Check
APPLY: Keys and roles literacy on Cyberlium avoids:
Multiple choice