Lion Cipher Lab
Right-size permissions with AWS IAM Access Analyzer (least privilege)
- Identity & Access Management
- Intermediate
- ~50 min
- Free · no account required
Why it matters
The biggest cloud breaches almost always trace back to an identity with more permissions than it needed — one leaked key that could touch everything. Least privilege is the antidote, and the hard part isn't agreeing with it, it's knowing exactly which permissions are 'needed'. IAM Access Analyzer answers that from real usage data instead of guesswork, turning 'least privilege' from a slogan into a policy you can actually generate and apply. This is a daily task for cloud security and IAM engineers.
What you'll learn
- least privilege
- IAM policies
- access analysis
- policy generation from activity
- reducing blast radius
Steps in this lab
- Least privilege — the idea, and why it's hard
- Set up: an over-broad role and CloudTrail
- Generate some real activity
- Generate a least-privilege policy from activity
- Review, tighten, and apply — with judgment
- When least privilege costs more than it's worth (and how to stage it)