Lion Cipher Lab
Write least-privilege AWS IAM policies with Policy Sentry
- Cloud Security
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Almost every serious cloud breach traces back to one identity holding far more permission than it needed. The lazy fix — `"Action": "s3:*", "Resource": "*"` — is exactly how that happens: it works, so nobody tightens it. Writing a genuinely least-privilege policy by hand is miserable, because AWS has thousands of actions and you cannot remember which ones a task needs or which are dangerous (policy edits, `iam:PassRole`). Policy Sentry turns 'least privilege' from a slogan into a file you generate: list your resource ARNs, bucket them by access level, and it prints a tightly-scoped policy.…
What you'll learn
- writing least-privilege IAM policies
- IAM CRUD access levels (Read/Write/List/Tagging/Permissions management)
- resource-scoped ARNs vs wildcards
- reducing blast radius
- generating policy JSON from intent with policy_sentry
Steps in this lab
- When you'd reach for this — author-from-intent vs analyze-what-you-have
- Install Policy Sentry (pip, no AWS anything)
- Initialize the local IAM database (offline, no credentials)
- Look at the enemy first — the lazy wildcard policy
- Write the CRUD template — your intent, bucketed by access level
- Generate the policy and read what came out
- Explore what exists at each access level with `query`
- Why resource-scoped ARNs beat wildcards — blast radius and privilege escalation
- When NOT to trust it blindly — the limits, and pairing with used-access data
- The way a pro does it — start from zero, add what breaks, guard with boundaries