Cloud Security Learning Journey on AWS

Hands-on labs & explorations • Progressive AWS security concepts • Building real scenarios step by step
A living portfolio documenting my path toward cloud security expertise.

Explore the Journey View GitHub Repo

My AWS Security Journey — Key Milestones

Last updated: February 2026 • More labs in progress...

AWS IAM Fundamentals -
User & Group Management with Managed Policies

This lab demonstrates core AWS Identity and Access Management (IAM) concepts including user, group, and role management, managed policy application, least-privilege enforcement, temporary credentials via STS, MFA enforcement, and trust modeling for internal and external auditors. The lab simulates a small team environment with Developers, Administrators, and Auditors.

AWS Security & Risk Concepts –
Manual Access Audit

This lab demonstrates a hands-on AWS IAM security review focused on identifying and mitigating over-privileged access, enforcing least privilege, and implementing temporary, auditable administrative access using IAM roles and STS — all within a Free Tier, single-account environment.

ACT I – Part 1
Privilege Escalation via iam:PassRole — Offensive Lab Report with Remediation

This hands-on offensive lab in an AWS Free Tier account used console-only access to simulate a low-privileged IAM user escalating privileges via IAM misconfigurations. It demonstrated a critical iam:PassRole + EC2 attack path, allowing full administrative execution without direct admin rights — a practical account compromise.

ACT I – Part 2
Social Engineering Through IAM

This lab highlighted AWS IAM social engineering risks by creating a low-privileged guest-contractor account that appeared safe (no admin rights, no IAM writes, no direct role assumption) but held the subtle iam:PassRole permission. Reviewers saw low risk, yet attackers could leverage it for elevated service influence — showing how perception gaps enable social engineering even when technical attacks are blocked. Key takeaway: Non-admin users can still create admin-level impact via hidden misconfigurations.

ACT I – Part 3
AWS IAM Privilege Escalation Case Study

This case study documents a controlled AWS lab exercise demonstrating how IAM misconfigurations involving iam:PassRole can lead to privilege escalation, even when traditional console‑based protections are in place.

ACT II — Building Automated Response (coming soon)

Lab: Created event-driven remediation with Lambda + EventBridge. Triggered on GuardDuty findings → auto-quarantine EC2, update security groups, notify via SNS. Focused on least-privilege and safe rollback.

Technical Notes & Architecture Decisions

Overall Learning Approach ▼

This portfolio documents my hands-on exploration of AWS IAM security fundamentals through targeted labs inspired by real-world challenges.

  • Core principle: Least privilege & defense-in-depth
  • Focus: IAM users, groups, roles, managed policies, temporary credentials (STS), MFA enforcement, privilege escalation risks
  • Tools used: IAM Console, IAM Access Analyzer, AWS CloudTrail, AWS CLI, IAM Policy Simulator
  • Goal: Build practical IAM security capability and demonstrate learning mindset for interviews
IAM Lab Overview

Core AWS Services & Skills Demonstrated

☁️ AWS
🪪 IAM
🔑 STS
📜 CloudTrail
🔒 MFA
📊 Access Analyzer

Demonstrated: User/group/role management • Managed policies • Least privilege enforcement • Temporary credentials • Privilege escalation simulation & mitigation • Auditing with CloudTrail