AWSIAMJSONIntermediate~4h

AWS: IAM & Security

One right answer per request

Policy evaluation is a published algorithm, not a judgement call: an explicit deny first, then the organisation, the resource, the identity, the boundary, the session, and a default deny beneath. So a request plus its policies has one answer, reachable with a pen — and with no AWS account, no console and no spend.

Start this project See the modules

Modules: 5
Drills: 14
Build steps: 0
Time: ~4h

Walk out able to

Read a request, a principal and the policies that apply, and say allow or deny — and which of the gates decided it, which is the half that gets it fixed.

What you drill

The evaluation chain

Deny, organisation, resource, identity, boundary, session.

Roles, sessions and trust

Who is calling, and who agreed to let them in.

Two doors into one resource

A union inside one account, a conjunction across two.

Grants against a brief

Name what a policy reaches past what was asked for.

The pitch

What you practise, and what you leave with

Mostly a reflex — a verdict you can defend — plus one written review of a four-document policy set against its requirement.

You will practise

ARN patterns, actions and condition blocks
The whole chain, explicit deny to session
Trust policies, assume-role and sessions
Resource policies, and grants against a brief

Afterwards you can

Say allow or deny, and name the gate
Read the principal a request really carries
Decide an assume-role from both sides
Name what a policy grants beyond its brief

Modules

5 modules, 23 items

Lessons explain one idea. Drills repeat it until it sticks. Build steps make something that exists afterwards.

1
Decide the request
~1h
Run the published chain over a policy set and name the step that decided it.
- LessonRun the chain on one request12 min
- LessonTell two refusals apart10 min
- DrillMatch an ARN to a pattern8 min
- DrillApply one statement to a request9 min
- DrillEvaluate a condition block10 min
- DrillSay allow or deny, and name why14 min
2
Know which identity is calling
~29 min
Say what the caller is presenting, what it expires into, and what the rules require.
- LessonRead what the caller is holding12 min
- DrillName the principal on the wire8 min
- DrillPick the identity the rule leaves9 min
3
Cross the trust boundary
~33 min
Decide an assume-role from both sides, and say what the session was left with.
- LessonRead both sides of a trust13 min
- DrillDecide whether the assume-role lands12 min
- DrillSay what the session policy left8 min
4
Read the policy on the resource
~31 min
Say who a resource policy reaches, and decide a request across an account line.
- LessonTwo doors into one bucket12 min
- DrillSay who this Principal reaches8 min
- DrillDecide it across an account line11 min
5
Grant no more than the requirement
~1h
Write a policy, measure it against a requirement, and name what it reaches past it.
- LessonMeasure a grant against a brief12 min
- DrillSay what the wildcard reaches8 min
- DrillFind what it grants beyond the brief11 min
- DrillCompute what the boundary leaves10 min
- DrillWrite the line the policy needs9 min
- LessonRead the set before reviewing it11 min
- LessonName what it grants past the brief10 min
- LessonWrite the review12 min