IAM & Cloud Security Essentials

By the end

What you'll build

• Read and write AWS IAM policy JSON fluently — Version, Statement, Effect, Action/NotAction, Resource/NotResource, Condition and (in resource policies) Principal.
• Apply IAM's evaluation logic by hand: default deny, explicit Allow, and explicit Deny that overrides any Allow.
• Use action and resource wildcards safely, avoiding the Get*-is-not-List* and object-ARN-vs-bucket-ARN traps.
• Constrain access with StringEquals, StringLike, IpAddress (prefix) and Bool conditions — including source-IP, tag-based, MFA and TLS-only rules.
• Design to the principle of least privilege and repair over-permissioned policies through error analysis.
• Distinguish identity-based from resource-based policies and lock down an S3 bucket (Block Public Access, HTTPS-only, scoped and tagged access).
• Compare network controls (stateful security groups vs stateless NACLs) and encryption choices (at rest vs in transit, SSE-S3/SSE-KMS, KMS decrypt separation).
• Choose the right secrets store (Secrets Manager vs Parameter Store) and never hardcode secrets.
• Investigate and respond to security incidents using CloudTrail, IAM Access Analyzer, and credential reports, framed by the Well-Architected Security Pillar.
• Practise on AWS's own free tier / AWS Educate using the IAM Policy Simulator and Access Analyzer, and honestly scope what a simulated course does and does not certify.

Curriculum

What's inside

6 modules · 35 lessons

1. 01

   The AWS Identity Model

   6 lessons
   • Welcome: How This Security Course Works
   • Root, Users, Groups & Roles
   • Authentication vs Authorization; MFA & Credentials
   • Trust Policies & Assuming Roles
   • Quiz: Identity Model Fundamentalsquiz
   • + 1 more lesson
2. 02

   Policy JSON Deep-Dive

   7 lessons
   • Anatomy of an IAM Policy
   • Policy Lab: Your First Allow Policypolicy lab
   • Actions, Wildcards & Resource ARNs
   • Policy Lab: Wildcards & Scoping Resourcespolicy lab
   • Request Evaluation: Explicit Deny Wins
   • + 2 more lessons
3. 03

   Conditions & Least Privilege

   6 lessons
   • Condition Operators: StringEquals, StringLike, IpAddress, Bool
   • Policy Lab: Conditions — Tag, IP & MFApolicy lab
   • The Principle of Least Privilege
   • Python Lab: Least-Privilege Diffpython lab
   • Error Analysis: Debugging Over-Permissioned Policiespolicy lab
   • + 1 more lesson
4. 04

   Resource Policies & S3 Lockdown

   5 lessons
   • Identity Policies vs Resource Policies
   • S3 Bucket Policies & Block Public Access
   • Policy Lab: Lock Down an S3 Bucketpolicy lab
   • Python Lab: S3 Public-Access Auditpython lab
   • Quiz: Resource Policy Scenariosquiz
5. 05

   Network Security & Encryption

   5 lessons
   • Security Groups vs NACLs
   • Encryption at Rest & In Transit; KMS Concepts
   • Secrets Management Concepts
   • Flashcards: Security Services — When to Use Whichflashcard sr
   • Quiz: Network & Encryptionquiz
6. 06

   Audit, Incident & Real Practice (Tier-2)

   6 lessons
   • Detection & Audit: CloudTrail, Access Analyzer, Credential Reports
   • Tier-2 Guided Lab A: The IAM Policy Simulator
   • Evidence Check A: What the Simulator Showedquiz
   • Tier-2 Guided Lab B: IAM Access Analyzer Policy Validation
   • Evidence Check B + Well-Architected Security Reviewquiz
   • + 1 more lesson

The shape of it

How this course works