Cloud › Module 1 › Lesson 2
Your Accounts Only
Your accounts only means YOUR personal free-tier or course sandbox under $CLOUD_LAB — document account IDs in notes before any console or CLI work.
Visual · t31_your_accounts_only
Account scope literacy. $CLOUD_LAB only. Original Cyberlium.
Opening
The subscription ID is part of scope — Cyberlium refuses cloud work on tenants and accounts you do not own or lack written permission to assess.
Your cloud lab account is a personal AWS/Azure/GCP sandbox YOU created, a courseware tenant labeled for training, or a Cyberlium sample scope shipped for Topic 31. Intentional misconfig drills live in $CLOUD_LAB only — never copied from employer exports or stranger recon lists. Cyberlium maps allowed accounts on YOUR $CLOUD_LAB inventory — provider, account or subscription ID, owner — never 'borrowed' employer subscriptions or scraped victim tenant IDs. Next: No Stranger Tenants.
1. Allowed lab surfaces (named)
Personal AWS account with free-tier guardrails. Personal Azure subscription with spending caps. Courseware cloud lab pack with explicit training labels. Cyberlium t31-cloud sample policy snippets with fictional resource names.
On $CLOUD_LAB, list provider, account or subscription ID, and owner — fictional resource names OK if labeled sample.
Command guide
Try these commands — Allowed lab surfaces (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
AWS security best practices — https://docs.aws.amazon.com/security/ Azure security baseline — https://learn.microsoft.com/en-us/security/benchmark/azure/ Shared responsibility — https://aws.amazon.com/compliance/shared-responsibility-model/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t31-cloud/notes" "$HOME/cyberlium-lab/t31-cloud/aws" "$HOME/cyberlium-lab/t31-cloud/azure" "$HOME/cyberlium-lab/t31-cloud/containers" "$HOME/cyberlium-lab/t31-cloud/k8s" "$HOME/cyberlium-lab/t31-cloud/tools" "$HOME/cyberlium-lab/t31-cloud/findings" cat > "$HOME/cyberlium-lab/t31-cloud/lab.env" <<'EOF' export CLOUD_LAB=$HOME/cyberlium-lab/t31-cloud export CLOUD_LAB_NOTES=$HOME/cyberlium-lab/t31-cloud/notes export CLOUD_LAB_AWS=$HOME/cyberlium-lab/t31-cloud/aws export CLOUD_LAB_AZURE=$HOME/cyberlium-lab/t31-cloud/azure export CLOUD_LAB_K8S=$HOME/cyberlium-lab/t31-cloud/k8s EOF
Command — copy this
chmod 600 "$HOME/cyberlium-lab/t31-cloud/lab.env" grep -E 'CLOUD_LAB' "$HOME/cyberlium-lab/t31-cloud/lab.env" curl -sS https://docs.aws.amazon.com/security/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: AWS security best practices (https://docs.aws.amazon.com/security/); Azure security baseline (https://learn.microsoft.com/en-us/security/benchmark/azure/); Shared responsibility (https://aws.amazon.com/compliance/shared-responsibility-model/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why account scope matters before cloud work
AWS CLI, Azure CLI, and CSPM tools are powerful on any tenant — scope is what keeps practice legal and ethical. Employer production subscriptions, stranger accounts, and scraped breach keys are out of scope.
If you cannot answer 'who owns this account and who approved this assessment?', pause and fix scope notes before running cloud commands.
3. Account inventory habit
Forbidden: using a trending leaked key dump because it 'looks like training.' Allowed: account card — provider, ID, owner, allowed operations (read IAM policy in YOUR sandbox, review S3 block public access only).
Ship: account inventory row for one $CLOUD_LAB provider. Next: No Stranger Tenants.
4. What you ship: cloud account inventory row for $CLOUD_LAB
Provider, account ID, owner, allowed ops. $CLOUD_LAB named. NEVER stranger tenants. chmod 600.
5. What you record before the next lesson
Date. Account inventory row. $CLOUD_LAB named. File t31-m01-l02-your-accounts-only.txt chmod 600.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Import employer subscription because lab account is boring. Skip account card because 'it's just the CLI.'
Right
Write account inventory row for YOUR $CLOUD_LAB provider. Next: No Stranger Tenants.
Mission: document YOUR cloud lab account
1) Name one personal or course sandbox account. 2) Record provider and account or subscription ID. 3) List two allowed operations on that account. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Personal free-tier sandboxes beat irreversible mistakes on employer production subscriptions.
Knowledge Check
APPLY: Your accounts only on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Reviewing IAM policies in an account YOU created is acceptable lab practice.
True or False
Knowledge Check
APPLY: Before running cloud CLI commands you should:
Multiple choice