Cloud › Module 3 › Lesson 4
Lab — IAM
Pack IAM basics, least privilege, and keys/roles cards — IAM literacy file from $CLOUD_LAB only.
Visual · t31_iam_lab
Lab: IAM pack. $CLOUD_LAB only. Original Cyberlium.
Opening
IAM pack merges basics to least privilege to keys — paperwork before AWS data module.
Lessons 3-1–3-3 named IAM objects, least privilege trim, and keys vs roles. This lab merges three sections with optional console read-only inventory from YOUR $CLOUD_LAB AWS account. Optional: list IAM users and roles in sandbox — log UTC only; no stranger account. Next: Quiz — AWS IAM Literacy.
1. Lab contract: IAM pack
Create $HOME/cyberlium-lab/t31-m03-l04-iam-lab.txt merging IAM basics, least privilege, and keys/roles sections with $CLOUD_LAB account ID and M1 ethics cross-reference.
Optional: paste redacted iam list-users summary — no access key values.
Command guide
Try these commands — Lab contract: IAM pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
IAM list policies — https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-user-policies.html IAM simulate — https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html AWS CLI IAM — https://docs.aws.amazon.com/cli/latest/reference/iam/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
pipx install awscli # or official AWS CLI v2
macOS:
Command — copy this
brew install awscli
Windows: Install AWS CLI v2 from Amazon
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}YOUR ACCOUNT — IAM lab: identity + attached policy count (read-only literacy)
Command — copy this
aws sts get-caller-identity aws iam list-users --max-items 5 2>/dev/null || echo 'IAM list requires YOUR account credentials' aws iam get-account-summary 2>/dev/null || echo 'Run against YOUR account only' cat > "$CLOUD_LAB/aws/iam-lab-findings.md" <<'EOF' # IAM Lab Findings — YOUR ACCOUNT ## Caller identity - Paste aws sts get-caller-identity output here (redact account ID if sharing) ## Review notes - Users with AdministratorAccess? - Access keys older than 90 days? - Unused roles in last 90 days? ## Scope - YOUR account only — no cross-account enumeration without authorization EOF
Command — copy this
grep -E 'YOUR ACCOUNT|Caller identity' "$CLOUD_LAB/aws/iam-lab-findings.md"
═══ WINDOWS ═══
YOUR ACCOUNT — IAM lab on Windows
Command — copy this
aws sts get-caller-identity Get-Content $HOME/cyberlium-lab/t31-cloud/aws/iam-least-privilege-checklist.md | Select-String MFA
Primary tools to practice this lesson: aws, grep. Reference sites: IAM list policies (https://docs.aws.amazon.com/cli/latest/reference/iam/list-attached-user-policies.html); IAM simulate (https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html); AWS CLI IAM (https://docs.aws.amazon.com/cli/latest/reference/iam/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check ethics
Grep for access key secrets, stranger account ARNs, AdministratorAccess on shared users — redact or delete. Pack labels all work as $CLOUD_LAB sandbox only.
Confirm no root key creation steps — literacy and trim plans only.
3. Lock the proof
chmod 600 on the pack. Quiz next — then S3 Hygiene.
IAM literacy feeds AWS data and logging lessons in M4.
4. What you ship: IAM literacy pack for $CLOUD_LAB
Merged basics, least privilege, keys/roles sections. $CLOUD_LAB named. NO key secrets in file. chmod 600.
5. What you record before the next lesson
Date. IAM pack path. $CLOUD_LAB named. File t31-m03-l04-iam-lab.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Paste live access key in pack. Include stranger account policy export.
Right
Write YOUR IAM literacy pack for $CLOUD_LAB. chmod 600. Next: Quiz — AWS IAM Literacy.
Mission: freeze YOUR IAM literacy pack
1) Merge M3 literacy sections. 2) Confirm zero key secrets or stranger refs. 3) Link M1 ethics cross-ref. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Delete accidental key from pack before quiz — rotate if unsure.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: IAM pack must not contain live access key secrets.
True or False
Knowledge Check
APPLY: IAM pack supports:
Multiple choice