- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
- Security
Create and Assume Roles in AWS
This hands-on lab guides you through creating and assuming IAM roles in AWS, a fundamental security pattern used in production environments. You'll learn how to implement role-based access control where an IAM user can assume a role with specific permissions, following the principle of least privilege. This lab demonstrates a real-world scenario where an internal auditor needs read-only access to S3 buckets without being granted permanent permissions directly to their user account. Throughout this lab, you'll explore existing IAM roles, create custom IAM policies and roles, configure trust relationships, and practice role assumption using the AWS Management Console. By the end, you'll understand how to securely grant temporary, scoped access to AWS resources using IAM roles.
Lab Info
Table of Contents
-
Challenge
Objective One: Explore an AWS Provided IAM Role
Examine an existing AWS service role of your choice to understand how permissions and trust relationships are structured. Identify what policies are attached to the role and analyze the trust policy to see which services can assume it.
Example policy:
AmazonSSMManagedInstanceCore -
Challenge
Objective Two: Locate Pre-Provisioned IAM and S3 Resources
- Verify that the preconfigured IAM user (
internal-audit-user) exists and confirm the IAM user currently has no assigned permissions. - Locate the two S3 buckets created for the lab environment. There should be an application and audit bucket available in S3.
- Verify that the preconfigured IAM user (
-
Challenge
Objective Three: Create the Permissions Policy
Design and deploy a custom customer managed IAM policy granting read-only access to Amazon S3 resources in the account.
Implement the policy using JSON syntax, name it
internal-auditor-s3and describe it appropriately. -
Challenge
Objective Four: Create the IAM Role and Trust Policy
Build a new IAM role called
internal-audit-rolethat grants S3 read access via the previously createdinternal-auditor-s3IAM policy.Define a trust policy that restricts role assumption to the
internal-audit-userARN and review both policy details before creating and recording the role ARN. -
Challenge
Objective Five: Grant the IAM User Permission to Assume the Role
Allow the
internal-audit-userto assume the new IAM role via an inline policy that allows the required STS actions:sts:AssumeRolests:GetSessionTokensts:TagSession
-
Challenge
Objective Six: Create Credentials for the Audit User, Login to the Audit User, and Test Role Assumption and Permissions
- Generate console login credentials for the
internal-audit-user, log in as that user, and verify the user’s limited access. - Then use the Switch Role feature to assume the
internal-audit-roleand confirm that granted S3 read permissions function as expected
- Generate console login credentials for the
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.