AWS IAM in practice: least privilege without the guesswork

IAM is where AWS security succeeds or fails. Most teams know they should follow least privilege, but in practice permissions grow: a wildcard added to fix a deploy, a managed policy attached because it worked, an old access key nobody remembers creating. This course gives you a method for doing better without slowing your team down.

What you will learn

• Exactly how AWS evaluates a request, across identity policies, resource policies, permission boundaries, session policies and organisation policies
• Writing precise policies with resources, conditions and tags
• Roles for workloads, cross account access and federation from CI systems with OpenID Connect
• Identity Center for people, with permission sets and short lived credentials
• Using IAM Access Analyzer to find external access, unused permissions and to generate policies from activity
• Guardrails with service control policies and resource control policies in AWS Organizations

How we work

Each lesson starts from a realistic request, such as "the reporting job needs to read one bucket" or "contractors need read only access to staging", and we build the policy, test it with the policy simulator and the CLI, then try to break it. You will practise in your own account with resources that cost little or nothing.