IAM (Identity and Access Management) and Access Analyzer are critical AWS security services that help enforce least-privilege access and identify overly permissive policies that could lead to security risks. IAM lets you define who can access your resources, while Access Analyzer helps detect unintended public or cross-account access. IAM Access Analyzer also recommends safer, usage-based permissions.
In this Challenge Cloud Lab, you will be tested on your ability to identify and remediate overly permissive IAM policies, using only the AWS Management Console. You’ll create users, roles, and resources with insecure access configurations, enable analysis tools, and use IAM Access Analyzer to detect and fix these security issues. You’ll also generate least-privilege policies based on real activity logs captured via AWS CloudTrail without guided steps.
A high-level architecture diagram for this Challenge Cloud Lab is provided below:
