Part of the DJames Network / DJames617
Explore the Network
DJames617Personal, professional, creative, and educational hub NerdDualCyber operations, intelligence, resources, and public tools HDJamesAuthenticated application lab and proving ground
DJames617 The DoWell Nerd

Hands-On Mini Lab

IAM Role and Temporary Credentials Lab

No AWS service charge for IAM or STS. Use a sandbox account.

Goal

Reinforce Trust policies, Permissions policies, STS temporary credentials, Least privilege through a small, inspectable activity.

Concepts Reinforced

  • Trust policies
  • Permissions policies
  • STS temporary credentials
  • Least privilege

Prerequisites

  • AWS CLI configured for a sandbox account
  • Permission to create and delete IAM roles

Estimated Cost

Exact Steps

  1. Create a role with a trust policy that allows your current principal to assume it.
  2. Attach a small permissions policy such as read-only access to one test bucket or no permissions beyond sts:GetCallerIdentity for inspection.
  3. Run aws sts assume-role with the role ARN and inspect the returned AccessKeyId, SecretAccessKey, SessionToken, and Expiration fields.
  4. Use the temporary credentials to run aws sts get-caller-identity and confirm the assumed-role ARN.
Runnable example after replacing placeholders
aws sts assume-role --role-arn arn:aws:iam::111122223333:role/DJamesStudyRole --role-session-name djames-study

Verification

  • The caller identity shows an assumed-role ARN.
  • The session expires and cannot be used indefinitely.
  • Actions outside the attached policy fail.

Cleanup Steps

  • Delete attached policies created for the lab.
  • Delete the IAM role.

Sources and Review Metadata

This independent training application is not affiliated with or endorsed by Amazon Web Services. AWS, Amazon Web Services, and AWS certification names are trademarks of Amazon.com, Inc. or its affiliates.