Lion Cipher Lab

Install and configure the AWS CLI the safe way — named profiles, no root keys, and a LocalStack fallback

Why it matters

Almost every hands-on cloud-security lab on this site — finding over-privileged roles with Access Analyzer, auditing an account with Prowler, reading CloudTrail, locking down a Lambda function, walking an attack path on LocalStack — starts with the AWS CLI already installed and already configured. The CLI is also where beginners make the single most expensive mistake in cloud: they create access keys for the root user, paste them into `aws configure`, and now a plain-text file in their home folder can do anything to the account, including run up a bill. This lab installs the tool and, more…

What you'll learn

Steps in this lab

  1. What the AWS CLI is, and why every cloud lab uses it instead of the website
  2. Before you start: what is free here, and what this lab refuses to touch
  3. Windows: install with the MSI, then open a NEW terminal
  4. macOS: install the pkg (double-click, or two commands)
  5. Linux: download, VERIFY the signature, then install
  6. The decision that matters: an IAM user's key, never root's (and what to do if you already made one)
  7. Create the CLI user: no console password, read-only, one key
  8. aws configure — with a NAMED profile, and where the files land
  9. Two commands that tell you the truth: configure list, and "who am I"
  10. Environment variables vs the files — and the order the CLI checks them
  11. The LocalStack fallback: a fake AWS on your own machine (no AWS account needed)
  12. One call against each: IAM on the real account, S3 on LocalStack
  13. Credential hygiene: the four rules, and how to rotate and delete a key
  14. The errors you'll actually hit, and what each one is really saying
  15. Prove it: four lines that say you did this the safe way
  16. What you just did — and why the profile name is the whole lesson

Open the full interactive lab →