Runbook 02 Enterprise IAM Security Assessment

Module: 02 – Identity & Access Management (IAM)

Enterprise Lab: 02

Estimated Time: 2–3 Hours

Difficulty: ⭐⭐⭐⭐☆

Estimated Cost: Free Tier (No additional AWS charges)

🎯 Objective

As a Cloud Security Engineer at CloudNova Technologies, you have been assigned to perform an enterprise IAM security assessment for an existing AWS environment.

By completing this runbook, you will learn how to:

Perform an IAM security audit
Identify security risks
Review IAM Users, Groups, Roles and Policies
Detect excessive permissions
Review MFA compliance
Review Access Keys
Review password policy
Review IAM Roles
Review IAM Access Analyzer findings
Generate Credential Reports
Recommend remediation actions
Produce an executive security assessment report

🏢 Business Scenario

CloudNova Technologies has grown rapidly over the last three years.

Multiple teams have created IAM users, groups and policies without following security standards.

Management has requested a complete IAM Security Assessment before the company proceeds with its ISO 27001 certification.

You have been assigned to review the AWS IAM environment and identify security weaknesses.

Your task is to assess the environment, document findings, implement improvements where appropriate, and present recommendations to management.

📋 Prerequisites

Complete:

Enterprise Runbook 01 – Secure Enterprise IAM Environment

Required:

AWS Account
IAM Administrator Access
AWS CLI Installed
Visual Studio Code

🏗 Current Enterprise Environment

CloudNova currently contains:

AWS Account

├── 35 IAM Users
├── 8 IAM Groups
├── 14 IAM Roles
├── Multiple Customer Policies
├── AdministratorAccess assigned to several users
├── Users without MFA
├── Old Access Keys
├── Unused IAM Users
├── Shared Administrator Account
└── No regular IAM review process

Management believes the environment is secure.

Your job is to verify this assumption.

Step 1 — Review IAM Dashboard

Open:

AWS Console

↓

IAM

Review:

Dashboard
Users
Groups
Roles
Policies
Access Reports
Account Summary

Document:

Total Users
Total Groups
Total Roles
MFA Status
Password Policy

CLI

aws iam get-account-summary

Step 2 — Review IAM Users

Console

IAM

↓

Users

Review each user.

Look for:

Unused users
Disabled users
Old accounts
Generic accounts
Shared accounts

CLI

aws iam list-users

Document:

Username
Last Activity
Purpose
Risk Level

Step 3 — Review IAM Groups

Review:

IAM

↓

User Groups

Questions:

Are permissions appropriate?
Are users assigned correctly?
Are groups still required?

CLI

aws iam list-groups

Step 4 — Review IAM Roles

Navigate to:

IAM

↓

Roles

Review:

Service Roles
Cross-Account Roles
EC2 Roles
Lambda Roles

Questions:

Is the trust policy correct?
Does the role follow least privilege?

CLI

aws iam list-roles

Step 5 — Review IAM Policies

Review:

AWS Managed Policies
Customer Managed Policies
Inline Policies

Identify:

Overly permissive policies
Wildcards (*)
AdministratorAccess
Unused policies

CLI

aws iam list-policies

Step 6 — Review MFA Compliance

Open:

IAM

↓

Users

Verify:

Administrator MFA
Security Team MFA
Developers MFA

Questions:

Which privileged users do not have MFA?

CLI

Generate Credential Report

aws iam generate-credential-report

Retrieve Report

aws iam get-credential-report

Review:

MFA Enabled
Password Enabled
Password Last Used

Step 7 — Review Password Policy

Navigate:

IAM

↓

Account Settings

Verify:

Minimum Length
Password Complexity
Expiry
Password Reuse

CLI

aws iam get-account-password-policy

Step 8 — Review Access Keys

Review:

Active Keys
Inactive Keys
Old Keys
Unused Keys

Questions:

Which keys should be rotated?
Which keys should be deleted?

CLI

aws iam list-access-keys \
--user-name USERNAME

Step 9 — Review IAM Access Analyzer

Open:

IAM

↓

Access Analyzer

Review:

External Access
Public Access
Cross-Account Access

Questions:

Are there unexpected external principals?
Which findings require immediate action?

Step 10 — Review Administrator Access

Identify every user, group and role with:

AdministratorAccess

Determine:

Is it justified?
Can permissions be reduced?
Should the user receive a custom policy?

Step 11 — Review Least Privilege

Select one Developer account.

Review permissions.

Questions:

Can the developer delete production resources?
Can the developer modify IAM?
Can the developer create new users?
Can the developer access billing?

Document all findings.

Step 12 — Create Security Findings

Document all identified risks.

Example:

Finding	Risk	Severity	Recommendation
AdministratorAccess assigned to Developers	High	Critical	Replace with Least Privilege Policy
No MFA on privileged account	High	Critical	Enable MFA Immediately
Old Access Keys	Medium	High	Rotate Keys
Shared Administrator Account	High	Critical	Create Individual Accounts
Unused IAM Users	Medium	Medium	Remove Users

Step 13 — Create Remediation Plan

Prepare a remediation roadmap.

Example:

Immediate (Within 24 Hours)

Enable MFA
Remove shared accounts
Remove inactive users

Short Term (30 Days)

Replace AdministratorAccess
Rotate Access Keys
Update Password Policy

Long Term (90 Days)

Implement IAM Identity Center
Quarterly IAM Reviews
Automated IAM Compliance Monitoring

Step 14 — Validation

Verify:

Risks Identified
Findings Documented
Credential Report Reviewed
Password Policy Reviewed
MFA Reviewed
Access Keys Reviewed
IAM Roles Reviewed
Least Privilege Evaluated
Recommendations Completed

🧪 Enterprise Challenge

CloudNova plans to expand from 50 employees to 500 employees over the next year.

Prepare an IAM strategy that includes:

Organisational structure
IAM Groups
IAM Roles
Identity Center
MFA Enforcement
Cross-Account Strategy
Access Review Process
Joiner / Mover / Leaver Process

Present your proposal as if you were briefing the Chief Information Security Officer (CISO).

📄 Deliverables

Capture screenshots of:

IAM Dashboard
IAM Users
IAM Groups
IAM Roles
IAM Policies
Password Policy
Credential Report
IAM Access Analyzer

Submit:

IAM Security Assessment Report
Risk Register
Remediation Plan
Executive Summary
Updated IAM Architecture Diagram

🧹 Cleanup

Do NOT delete:

IAM Groups
IAM Roles
IAM Users required for future labs
Password Policy
IAM Access Analyzer

If you created any temporary users, policies or roles during testing, remove them before completing the lab.

✅ Runbook Checklist

💡 Lessons Learned

What were the most critical IAM risks identified?

How does the Principle of Least Privilege improve security?

Which remediation activities should be prioritised?

How can IAM reviews become part of ongoing security operations?

🚀 Next Module

03 — AWS Organizations & Multi-Account Security

In the next module, you will learn how enterprises manage multiple AWS accounts securely using AWS Organizations, Organizational Units (OUs), Service Control Policies (SCPs), centralized governance, and cross-account security controls.