Runbook 01 Secure Enterprise IAM Environment

Module: 02 – Identity & Access Management (IAM)

Enterprise Lab: 01

Estimated Time: 2–3 Hours

Difficulty: ⭐⭐⭐☆☆

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, your first responsibility is to design and implement a secure Identity and Access Management (IAM) environment.

By completing this runbook, you will:

Understand IAM fundamentals
Create IAM Users
Create IAM Groups
Create IAM Roles
Create IAM Policies
Configure Password Policies
Enable Multi-Factor Authentication (MFA)
Configure IAM Identity Center
Review IAM Access Analyzer
Generate Credential Reports
Validate the IAM environment
Build an enterprise-ready IAM structure

🏢 Business Scenario

CloudNova Technologies has recently hired several new employees.

You have been asked to build a secure IAM environment before they receive access to AWS.

The company has the following teams:

Cloud Engineering
DevOps
Developers
Cloud Security
SOC
Auditors
Finance

Each team requires different permissions.

Your goal is to provide secure access following the Principle of Least Privilege.

📋 Prerequisites

Complete:

AWS Security Foundations Module

Required:

AWS Account
Administrator IAM User
MFA Enabled
AWS CLI Installed
Visual Studio Code

🏗 Enterprise Design

AWS Account

│

├── Cloud Engineering
│      ├── cloud-eng01
│      └── cloud-eng02
│
├── Developers
│      ├── dev01
│      └── dev02
│
├── Security Team
│      ├── sec01
│      └── sec02
│
├── SOC
│      └── soc01
│
├── Finance
│      └── finance01
│
└── Auditors
       └── audit01

Step 1 — Review Existing IAM Environment

Open:

AWS Console

↓

IAM

Review:

Users
Groups
Roles
Policies
MFA
Identity Center

CLI

aws iam list-users

aws iam list-groups

aws iam list-roles

aws iam list-policies --scope Local

Step 2 — Create IAM Groups

Create the following groups:

Cloud-Engineering

Developers

Security

SOC

Finance

Auditors

AWS Console:

IAM

↓

User Groups

↓

Create Group

CLI Example

aws iam create-group \
--group-name Developers

Repeat for all groups.

Step 3 — Create IAM Users

Create users:

cloud-eng01

cloud-eng02

dev01

dev02

sec01

sec02

soc01

finance01

audit01

Console:

IAM

↓

Users

↓

Create User

Enable:

Console Access

Do not create long-term access keys unless required for the lab.

CLI Example

aws iam create-user \
--user-name dev01

Step 4 — Add Users to Groups

Assign users:

User	Group
cloud-eng01	Cloud-Engineering
cloud-eng02	Cloud-Engineering
dev01	Developers
dev02	Developers
sec01	Security
sec02	Security
soc01	SOC
finance01	Finance
audit01	Auditors

CLI Example

aws iam add-user-to-group \
--group-name Developers \
--user-name dev01

Step 5 — Configure Password Policy

Navigate to:

IAM

↓

Account Settings

Configure:

Minimum Length: 14
Uppercase
Lowercase
Numbers
Symbols
Password Expiry: 90 Days
Password History: 24

CLI

aws iam get-account-password-policy

Step 6 — Enable MFA

Enable MFA for:

Administrator
Security Team
Cloud Engineers

Recommended:

Virtual MFA Device

Validation:

Every privileged user should require MFA before signing in.

Step 7 — Review AWS Managed Policies

Explore policies such as:

ReadOnlyAccess
PowerUserAccess
SecurityAudit
AdministratorAccess

Discuss:

When should each policy be used?
Which policies should never be assigned permanently?

Step 8 — Create a Custom IAM Policy

Create a customer-managed policy that allows developers to:

Read Amazon S3
Upload objects to a specific project bucket
Deny bucket deletion

Review the JSON policy before creating it.

Discuss how custom policies provide finer control than broad managed policies.

Step 9 — Create an IAM Role

Create a role for EC2.

Steps:

IAM

↓

Roles

↓

Create Role

↓

AWS Service

↓

EC2

Attach:

AmazonSSMManagedInstanceCore

Discuss:

Why use roles instead of storing access keys on EC2?

Step 10 — IAM Access Analyzer

Navigate to:

IAM

↓

Access Analyzer

Create an analyzer.

Review findings.

Discuss:

External access
Public access
Cross-account permissions

Step 11 — Generate Credential Report

Generate a credential report.

Console:

IAM

↓

Credential Report

CLI

aws iam generate-credential-report

Retrieve the report:

aws iam get-credential-report

Review:

Users without MFA
Unused passwords
Old access keys
Inactive users

Step 12 — Validation

Verify:

IAM Groups created
IAM Users created
Users assigned correctly
Password Policy configured
MFA enabled
IAM Role created
Credential Report generated
Access Analyzer reviewed

🧪 Enterprise Challenge

CloudNova Technologies currently has:

Every user assigned AdministratorAccess
No MFA
Shared administrator account
Long-term access keys
No IAM groups

Your task:

Prepare an improvement plan.

Include:

Risks
Recommended IAM structure
MFA rollout
Least Privilege model
Long-term recommendations

📄 Deliverables

Capture screenshots of:

IAM Dashboard
IAM Users
IAM Groups
IAM Roles
Password Policy
MFA
IAM Access Analyzer
Credential Report

Submit:

IAM User Matrix
Group Matrix
Improvement Plan

🧹 Cleanup

Do NOT delete:

IAM Groups
IAM Roles
Password Policy
MFA
IAM Users

These resources will be used in later modules.

Delete only:

Temporary test users
Test policies
Experimental roles

✅ Runbook Checklist

💡 Lessons Learned

What did you learn?

Which IAM best practices are most important?

Which risks did you identify?

How does IAM support the Principle of Least Privilege?

🚀 Next Enterprise Runbook

Enterprise Runbook 02 — Enterprise IAM Security Assessment

In the next runbook, you will audit an intentionally insecure AWS IAM environment, identify security weaknesses, and implement remediation actions just as a Cloud Security Engineer would in a real enterprise.