Lion Cipher Lab
Least-privilege IAM on your own AWS account
- Cloud Security
- Beginner
- ~40 min
- Free · no account required
Why it matters
In the cloud, least privilege is the whole game: almost every serious cloud breach traces back to an identity that could do far more than it ever needed to, so the single most valuable habit you can build is giving each user, role, and service only the permissions its job requires and nothing else. This lab makes that abstract rule physical. You create a real limited user, hand it one narrow permission instead of the all-powerful AdministratorAccess, and then watch — with your own eyes, on your own account — the allowed action work and every other action get denied. That allow-here,…
What you'll learn
- least privilege
- IAM users and policies
- reading a JSON policy
- attaching managed policies
- testing allow vs deny
- cleaning up test identities
Steps in this lab
- The one idea: least privilege, and why root never does daily work
- Read a policy first: Effect, Action, Resource
- Create a limited IAM user to be the subject of the test
- Attach ONE narrow policy — not AdministratorAccess
- Prove the allowed action works
- Prove everything else is DENIED
- Clean up: delete the access key and the test user
- What you just did — and why it's the whole game