Lion Cipher Lab
Build an AWS data perimeter with SCPs, RCPs and VPC endpoint policies (offline evaluator, measured)
- Cloud Security
- Advanced
- ~90 min
- Free · no account required
Why it matters
Most cloud data theft does not need an exotic exploit. It needs one of three things: a valid identity copying your data to a place you do not own, an outside identity reaching in through a policy that grants too much, or stolen credentials used from somewhere you would never expect. AWS's answer is a data perimeter -- a small set of organization-wide Deny rules that hold no matter how careless any single team's policy is. The hard part is not writing the Deny. The hard part is knowing who each guardrail actually applies to, which condition keys go missing on which network paths, and which…
What you'll learn
- Explaining the three data-perimeter questions (trusted identity, trusted resource, expected network) and which policy type answers each
- Knowing exactly WHO an SCP, an RCP and a VPC endpoint policy apply to -- and who they silently skip
- Writing perimeter Deny statements with aws:PrincipalOrgID, aws:ResourceOrgID, aws:SourceIp, aws:SourceVpc and the ...IfExists operators
- Adding the documented exceptions (aws:PrincipalIsAWSService, aws:ViaAWSService, partner accounts, aws:SourceOrgID) so legitimate traffic keeps working
- Measuring a guardrail rollout as two numbers -- threats blocked and legitimate requests broken -- instead of one
- Stating honestly what a data perimeter cannot stop
Steps in this lab
- What a data perimeter is, in three questions
- The five policy types, and exactly who each one applies to
- Condition keys that are sometimes missing, and why that is the whole game
- Get set up (from zero)
- Build the engine: who applies, what exists, then deny-allow-grant
- Build the toy organization, 21 requests and 9 layers
- Run it: the measured before/after table
- Layers 1-2: trusted resources (SCP with aws:ResourceOrgID)
- Layers 3-5: trusted identities (RCP with aws:PrincipalOrgID), and the service confused deputy
- Layers 6-7: expected networks (SCP with aws:SourceIp and aws:SourceVpc)
- Layer 8: the VPC endpoint policy catches the request nobody else sees
- What survives all eight layers, and what a perimeter never sees
- Where this model is simpler than AWS
- How a professional rolls this out for real