Lab — IAM Hygiene on an Account You Own

Own means you may change IAM without asking a school, employer, friend, or random internet stranger. A personal AWS/GCP/Azure (or other) project you created with YOUR payment and YOUR email is in scope. A company org you do not administer is out unless you already have written permission that lists this hygiene work — Cyberlium does not invent that permission. A classmate’s login is out. A video of someone else’s console is not your lab. If this computer is a locked work laptop, you may still complete MFA rows on a personal cloud account you control from a browser you are allowed to use — or you skip.

Skip is first-class. No cloud is not a reason to steal a card, phish a console, or browse a public-bucket map. Write skip=yes, a reason, and hypothetical controls you would own. The checker PASSes a skip file that still has the legal line, ethics, and hypothetical rows. It FAILs a file that brags about a stranger’s console. Python PASS is not a substitute for your eyes.

cat > "$NOTES" << 'EOF'
=== IAM LAB (Cyberlium M19 L04) ===
ACCOUNT: (MY cloud / HONEST_SKIP)
MFA_ON_OWNER: (Y/N/skip)
ACCESS_KEY_METADATA: (age/last-used of MY keys — NEVER the secret)
ETHICS: never another tenant, never paste secrets
EOF

Root/owner/subscription-admin is the break-glass identity. If it has only a password, it is a single factor for the whole account. On an account you own, open the security page the provider documents for that identity and record whether a second factor is on. Then record MFA for the daily console user you actually use. Provider click-paths move; write the path you used, not a memorized 2019 screenshot. Do not enroll MFA on a shared club login you do not own. Do not reset a classmate’s factor “to help.” SMS-only is weaker than an authenticator app; write what you actually have, then improve on YOUR account if you can.

If root MFA is off and you own the account, turning it on is the lab. Skip reasons are: no account, or you are not authorized to change this org. Do not screenshot QR secrets or paste backup codes. chmod 600 exists because this file will say whether MFA is on — still not the codes.

grep "MFA_ON_OWNER" "$NOTES"

In YOUR identity console, open users or service accounts you created and write how many long-lived access keys exist, and whether any are unused. That is a count. It is not the secret key material. Never paste a secret into cloud-iam-lab.txt. Never create a new standing key so the count is non-zero. Prefer zero human access keys if console plus MFA already works. If you already use YOUR provider CLI against YOUR account, you may list key metadata for users you own. You may not point that CLI at another account, another profile you do not own, or a guessed tenant. This lab does not include storage listing of buckets you do not own.

Failure modes that still pass if you tell the truth: you own an account but have no access keys — write count 0. Failure modes that fail: a roommate’s IAM, listing other tenants’ keys, pasting secrets, scanning public buckets because “the lab was too small,” notes chmod 644 on a shared PC.

sudo apt install python3

brew install python3

python3 - << 'PY'
from pathlib import Path
t = (Path.home()/'cyberlium-lab'/'cloud-iam-lab.txt').read_text(encoding='utf-8','replace').lower()
print('FAIL secret' if 'aws_secret_access_key' in t else 'PASS: no secret key material in notes')
PY

Opening a stranger’s console is their control plane. Scanning other tenants’ buckets is Lesson 2’s banned hunt. Grayhat public-bucket sites are still out. Do not copy an account ID from a YouTube console. Do not join a Discord “shared AWS for CEH.” If someone offers a login that is not yours, refuse. If you are unsure the account is yours, you stop.

Work accounts: a status you are already shown as an employee (YOUR user has MFA) can be a fact you are allowed to see. Changing someone else’s policy or exporting the org’s IAM as a trophy is not this homework. When in doubt, skip and write the hypothetical.

Required of every file: legal line (original Cyberlium teaching mapped to the CEH v13 cloud-computing domain — not official EC-Council training, not a cert, not exam dumps); completion live_account or skip_hypothetical; ethics (no stranger console, no other-tenant bucket scan, no grayhat hunt, no secret paste); chmod 600. Live files add: provider, root/owner MFA, console-user MFA, access-key count for users you own, unused keys noted, block-public-access reminder from Lesson 2 as a yes/no you already checked or “not this sitting.” Skip files add: skip_reason (no cloud I own — never “I used a stranger”), and hypothetical_i_would_own: MFA on root, no standing keys in git, trail on, block public access, least privilege.

The checker only reads YOUR file. It does not call a cloud API. It does not prove MFA is on — you do. A PASS with a foreign account ID you should not have is an ethics fail you catch with your eyes. Do not gist the file. World-writable 777 fails.

Run the block on a machine you own. Edit parentheticals. Re-run the checker until PASS. Then chmod 600. Do not add cloud scanners. Do not add a second account that is not yours. Windows: WSL/Git Bash, or create the same text file in your profile and restrict ACLs if chmod is missing.

sudo apt install python3

brew install python3

cd "$HOME/cyberlium-lab"

cat > "$NOTES" << 'EOF'
=== CLOUD IAM HYGIENE LAB (Cyberlium M19 L04) ===
legal: original Cyberlium teaching mapped to CEH v13 cloud-computing domain — not official EC-Council training, not a cert, not exam dumps
date_utc:
completion: live_account | skip_hypothetical   (pick ONE)

provider: (AWS / GCP / Azure / other I own)
root_or_owner_mfa: on | off | n/a
console_user_mfa: on | off | n/a
access_key_count_for_users_i_own: (number — metadata only, NEVER paste secrets)
unused_keys_noted: yes | no | none
block_public_access_reminder: on | off | not-this-sitting | n/a

skip_reason: (no cloud account I control — I did NOT open a friend's/work/stranger console)
hypothetical_i_would_own: MFA on root/owner and console users; no long-lived keys in git; CloudTrail-style logs on; block public access; least privilege; never other tenants

ethics: NEVER stranger console; NEVER scan other tenants' buckets; NEVER grayhat public-bucket hunting; NEVER paste access-key secrets; NEVER mint extra standing keys for class
notes_path: $HOME/cyberlium-lab/cloud-iam-lab.txt
EOF

cat > check_cloud_iam_lab.py << 'PY'
from pathlib import Path

path = Path.home() / "cyberlium-lab" / "cloud-iam-lab.txt"
text = path.read_text(encoding="utf-8")
keys = [
"legal",
"completion",
"ethics",
"NEVER stranger console",
]
missing = [k for k in keys if k not in text]
if missing:
raise SystemExit("FAIL missing keys: " + ", ".join(missing))
if "not official EC-Council" not in text and "NOT official EC-Council" not in text:
raise SystemExit("FAIL disclaimer must say this is not official EC-Council training")
low = text.lower()
if "live_account" not in low and "skip_hypothetical" not in low:
raise SystemExit("FAIL pick completion: live_account or skip_hypothetical")
if "skip_hypothetical" in low and "skip_reason" not in low:
raise SystemExit("FAIL skip requires skip_reason")
if "skip_hypothetical" in low and "hypothetical_i_would_own" not in low:
raise SystemExit("FAIL skip requires hypothetical_i_would_own")
for b in ("I opened a stranger", "used a classmate login", "scanned other tenants"):
if b.lower() in low:
    raise SystemExit("FAIL ethics: do not treat a stranger console or tenant scan as completion")
print("PASS: required headings present for", path)
print("ethics reminder: YOUR account or skip+hypothetical; chmod 600; no stranger console")
print("checker does not prove MFA — your eyes do")
PY

python3 check_cloud_iam_lab.py || python check_cloud_iam_lab.py

You now treat cloud IAM hygiene as MFA plus standing-key counts on an account you own — or as an honest skip with a hypothetical you would own. Other tenants, grayhat bucket hunts, and borrowed consoles stay out. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 cloud-computing domain — not official EC-Council training, not a cert, not exam dumps. Next — Quiz — Cloud Computing — ten APPLY items on shared responsibility and secrets, then Hashing vs Encryption (CEH Recap).