Lab · Cloud Computing (AWS, Azure, Google Cloud)
Lab: a safe AWS account, and how IAM decides
The brief
Prove your AWS learning account is set up the safe way: the AWS CLI version 2 working in Mumbai, daily work done as an admin identity and not the root user, and a budget that emails you before a bill surprises you. Then write the rule AWS uses for every request: an explicit Deny beats any Allow, and anything not allowed is denied.
Why it matters
The first job of a cloud engineer in any company is to make sure nobody works as root, every account has a budget, and permissions are no wider than needed. Misreading a policy is how data leaks and surprise bills happen, so support engineers are often asked in interviews to explain why a request was allowed or denied.
Skills you practise
- AWS CLI version 2
- aws sts get-caller-identity
- root user versus IAM identities
- AWS Budgets
- IAM policy evaluation: explicit deny, allow, implicit deny
- wildcards in actions and ARNs
You need
- An AWS account (on the Free plan with credits if it was opened after 15 July 2025; read the current AWS Free Tier page)
- AWS CLI v2 configured with an IAM Identity Center or IAM user profile, not root, with region ap-south-1; AWS CloudShell in Mumbai also works
- MFA turned on for the root user, and no root access keys
What you will have at the end
Pasted proof that your account uses AWS CLI v2 in Mumbai, an identity that is not root, and a budget with alerts; plus iam_check.py, a tested IAM policy evaluator with wildcards.
How it is marked (rubric, 100 points)
| Safe accountCLI v2 in ap-south-1, a non-root identity, root has MFA and no keys, and a budget with alerts exists. | 40 |
|---|---|
| Correct evaluatormatches() and evaluate() pass every check: explicit deny wins, the default is implicit deny, wildcards and case rules work. | 40 |
| Can explainYou can explain to a teammate why S3_ADMIN plus NO_DELETES still cannot delete an object. | 20 |
0/5 steps done
Step 1 of 5
The CLI is version 2 and points at Mumbai
aws --version shows aws-cli/2, and the availability zones listed are Mumbai's (ap-south-1a, 1b, 1c).
The AWS CLI version 1 is old and missing features; this course uses version 2. The second command lists the availability zones of your current region. If it shows us-east-1a and friends, your commands are going to North Virginia, not Mumbai, and your data would leave India.
Set the region once in your profile (aws configure, or aws configure sso), or open CloudShell from the console with Asia Pacific (Mumbai) selected. Nothing here costs money.
$ aws --version; aws ec2 describe-availability-zones --query "AvailabilityZones[].ZoneName" --output textYour notes: iam_check.py
Write down each command you ran. It goes into your project summary.