← Blog

Writing archive

Blog page 28

Older notes, lessons, and series entries from the growing technical library.

Archive

Posts page 28

Showing 1,297-1,344 of 1,422

2 min readSeries: AWS from Zero · Part 126

IAM Advanced: Get access key last used from the CLI

Use the AWS CLI to get access key last used in IAM Advanced, identify required inputs, and inspect the modeled response.

#aws#cli#iam-advanced#security#identity
2 min readSeries: AWS from Zero · Part 125

Clean up IAM users groups roles and policies

Remove the AWS from Zero IAM demo resources in the dependency order IAM requires.

#aws#cli#iam#security#identity#cleanup
2 min readSeries: AWS from Zero · Part 124

Download and inspect the IAM credential report

Decode the IAM credential report CSV and query important security columns.

#aws#cli#iam#security#identity#audit
2 min readSeries: AWS from Zero · Part 123

Generate an IAM credential report

Request an account-wide IAM credential report and wait until generation completes.

#aws#cli#iam#security#identity#audit
2 min readSeries: AWS from Zero · Part 122

Rotate an IAM access key with overlap

Create a replacement key, test it, deactivate the old key, and finish rotation safely.

#aws#cli#iam#security#identity#credentials
2 min readSeries: AWS from Zero · Part 121

Deactivate and reactivate an IAM access key

Change one access key status without deleting the credential immediately.

#aws#cli#iam#security#identity#credentials
2 min readSeries: AWS from Zero · Part 120

List IAM access key metadata

Inventory an IAM user's access key IDs, status values, and creation dates without exposing secrets.

#aws#cli#iam#security#identity#credentials
2 min readSeries: AWS from Zero · Part 119

Create an IAM user access key carefully

Create one long-term IAM user access key and handle the secret as a one-time output.

#aws#cli#iam#security#identity#credentials
2 min readSeries: AWS from Zero · Part 118

Name and limit an STS role session

Set role session name, source identity, and duration for traceable temporary access.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 117

Configure an automatic assume-role CLI profile

Create a named AWS CLI profile that assumes a role and refreshes temporary credentials automatically.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 116

Use STS temporary credentials in shell variables

Load assumed-role credentials into environment variables, prove identity, and unset them.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 115

Assume an IAM role with STS

Request temporary credentials for an IAM role and inspect the assumed-role identity.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 114

List every policy on an IAM role

Audit both managed policy attachments and inline policy names for a role.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 113

Attach a managed policy to an IAM role

Grant a role read-only S3 account listing permission through a customer managed policy.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 112

Update an IAM role trust policy

Replace a role trust policy with a narrower named-user principal.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 111

Inspect an IAM role and its trust policy

Read role metadata and the assume-role policy document from the CLI.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 110

Create an IAM role with a trust policy

Create a role whose trust policy allows principals in the current account to request assumption.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 109

Simulate an IAM principal policy

Ask IAM how a named user policy set evaluates selected actions and resources.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 108

Prove that explicit IAM Deny wins

Use the IAM policy simulator to compare an Allow with a matching explicit Deny.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 107

Restrict an IAM policy by source IP

Add an aws:SourceIp condition to a policy and validate the document.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 106

Understand IAM Resource ARNs

Match IAM actions to exact bucket, object, role, and policy resource ARN shapes.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 105

Understand IAM Action wildcards

Compare one exact IAM action with narrow and broad wildcard action patterns.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 104

Write a least-privilege S3 read policy

Create an IAM policy that lists one bucket prefix and reads only objects under that prefix.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 103

Create and remove an inline IAM user policy

Put, read, and delete a small policy embedded directly in one IAM user.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 102

Delete an old IAM policy version

Remove one non-default managed policy version after verifying it is no longer needed.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 101

List IAM managed policy versions

Review every stored policy version and identify the active default.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 100

Create a new IAM managed policy version

Update a customer managed policy by creating and selecting a new default version.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 99

Detach a managed policy from an IAM user

Remove one direct managed-policy attachment and verify it is absent.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 98

Attach a managed policy to an IAM user

Attach one customer managed policy to a user and verify the direct attachment.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 97

Read an IAM managed policy document

Resolve a managed policy's default version ID and retrieve its JSON permissions document.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 96

Inspect IAM managed policy metadata

Read a managed policy's ARN, path, attachment count, update time, and default version.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 95

Create a customer managed IAM policy

Create a reusable customer managed policy from a validated JSON document.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 94

Understand IAM policy JSON anatomy

Build and validate a small identity policy with Version, Statement, Effect, Action, and Resource.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 93

List inline policies on an IAM user

List inline policy names and retrieve one embedded policy document.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 92

List managed policies attached to an IAM user

Return the names and ARNs of managed policies directly attached to one user.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 91

Distinguish IAM managed and inline policies

List attached managed policies and inline policy names for the same IAM user.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 90

Remove an IAM user from a group safely

Remove group membership, verify both resources, and delete an empty demo group.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 89

List every group for an IAM user

Inspect all IAM group memberships for one user.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 88

Add an IAM user to a group

Add one IAM user to a group and verify the membership from both directions.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 87

Create an IAM user group

Create an IAM group that can later receive shared permission policies.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 86

Query IAM user tags

Filter IAM user tags and return one tag value with JMESPath.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 85

Tag an IAM user

Add ownership and environment tags to an existing IAM user.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 84

Create an IAM user without credentials

Create a bare IAM user from the CLI without a console password or access key.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 83

Inspect one IAM user

Retrieve one IAM user's ARN, path, stable ID, creation date, and password-use timestamp.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 82

List IAM users in an AWS account

List IAM user names, ARNs, paths, and creation dates with a compact CLI query.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 81

Read your AWS caller identity deeply

Interpret the account, user ID, and ARN returned by STS get-caller-identity.

#aws#cli#iam#security#identity
2 min readSeries: AWS from Zero · Part 80

Build a private S3 backup bucket from the CLI

Combine naming, encryption, versioning, public-access blocking, lifecycle, upload, verification, and cleanup.

#aws#cli#s3#storage#project#security
2 min readSeries: AWS from Zero · Part 79

Restore an archived S3 object temporarily

Request a temporary restore of an S3 Glacier Flexible Retrieval object and inspect progress.

#aws#cli#s3#storage#archive#cost