🪪 AWS IAM शाळेच्या पद्धतीने शिका

# the 60-second wow — every lesson's decision, live:
git clone https://github.com/BaluRaut/learn-iam-school.git && cd learn-iam-school
python3 iam/demo.py                # 12 lessons, every decision with its reason
python3 iam/test_iam.py            # 12 checks, one per lesson

तुम्हाला काय दिसायला हवे (छाटलेले — यश असे दिसते):

═══ why ═══
── every request is signed: WHO is asking, WHAT action, on WHICH thing — the ID office decides
   🚫 aishwarya, no policies yet → s3:GetObject          IMPLICIT DENY — no policy allows it — AWS denies by default
   🧾 CloudTrail writes one line per request: time · who · action · resource · decision
   🗝️ the root account is NOT evaluated by these rules — it can do everything; lock it away with MFA

═══ users ═══
── the teachers group carries the policies; people only join or leave the list
   ✅ aishwarya (teachers) reads a report                ALLOW         — identity policy read-reports#ReadReports allows it
   ✅ katrina (teachers) reads a report                  ALLOW         — identity policy read-reports#ReadReports allows it
   🚫 dipika (no groups) reads a report                  IMPLICIT DENY — no policy allows it — AWS denies by default
   ✅ dipika joins teachers → reads a report             ALLOW         — identity policy read-reports#ReadReports allows it

═══ policies ═══
── one statement, four fields: {"Sid": "OwnFolderOnly", "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": "arn:aws:s3:::school-homework/${aws:username}/*"}
   ✅ aishwarya puts school-homework/aishwarya/essay.txt ALLOW         — identity policy own-homework-folder#OwnFolderOnly allows it
   🚫 aishwarya puts school-homework/katrina/essay.txt   IMPLICIT DENY — no policy allows it — AWS denies by default
   ${aws:username} is filled in per caller — one policy, a private folder for every teacher

═══ decide ═══
── start at DENY · an Allow opens the door · an explicit Deny slams it, whatever else says yes
   ✅ katrina, admin policy → DeleteObject report        ALLOW         — identity policy admin#Everything allows it
   ⛔ katrina, admin + deny-delete → DeleteObject        DENY          — explicit Deny in identity policy deny-delete-reports#NeverDeleteReports — nothing overrides it
   ✅ katrina, admin + deny-delete → GetObject           ALLOW         — identity policy admin#Everything allows it
   🚫 dipika, nothing attached → GetObject               IMPLICIT DENY — no policy allows it — AWS denies by default

═══ roles ═══
   🎩 ci-robot asks to wear ci-deployer → trust policy lets them ✅
   🎩 dipika asks to wear ci-deployer → trust policy refuses 🚫
   🎟️ temporary credentials (an example): AccessKeyId ASIAEXAMPLECIDEPLOY · SessionToken … · Expiration +1 hour — nothing long-lived to leak
   ✅ role session → ecr:PutImage                        ALLOW         — identity policy ci-deploy#PushImages allows it
   🚫 same session + read-only session policy            IMPLICIT DENY — outside the session policy passed to AssumeRole

═══ machines ═══
── GitHub Actions shows a signed OIDC token; the role's trust policy checks its claims — no stored AWS key at all
   ✅ token sub = repo:BaluRaut/school-app:ref:refs/heads/main         → role assumed, 1-hour credentials
   🚫 token sub = repo:BaluRaut/school-app:ref:refs/heads/feature-x    → refused
   🚫 token sub = repo:someone/fork:ref:refs/heads/main                → refused
   EC2: instance profile · Lambda: execution role · EKS: IRSA / Pod Identity — same idea: the platform hands out the badge

═══ conditions ═══
   🚫 aishwarya, no MFA → iam:CreateUser                 IMPLICIT DENY — no policy allows it — AWS denies by default
   ✅ aishwarya, with MFA → iam:CreateUser               ALLOW         — identity policy iam-needs-mfa#IamOnlyWithMfa allows it
   ✅ katrina from the office 203.0.113.40               ALLOW         — identity policy read-reports#ReadReports allows it
   ⛔ katrina from a café 198.51.100.9                   DENY          — explicit Deny in identity policy office-network-only#DenyOutsideOffice — nothing overrides it
   ✅ team=maths stops a team=maths instance             ALLOW         — identity policy abac-own-team#StartStopOwnTeam allows it
   🚫 team=maths stops a team=science instance           IMPLICIT DENY — no policy allows it — AWS denies by default
   ABAC: one policy, tags decide — a new team needs a tag, not a new policy

═══ guardrails ═══
   ✅ dev with admin, no boundary → iam:CreateUser       ALLOW         — identity policy admin#Everything allows it
   🚫 dev with admin + boundary → iam:CreateUser         IMPLICIT DENY — outside the permission boundary — the boundary is a ceiling, not a grant
   ✅ dev with admin + boundary → s3:PutObject           ALLOW         — identity policy admin#Everything allows it
   ✅ admin in the org, ap-south-1 → RunInstances        ALLOW         — identity policy admin#Everything allows it
   ⛔ admin in the org, sa-east-1 → RunInstances         DENY          — explicit Deny in SCP scp-two-regions#OnlyMumbaiAndVirginia — nothing overrides it
   effective = identity ∩ boundary ∩ session ∩ SCP — guardrails only ever take away

═══ crossaccount ═══
   ✅ partner auditor: both sides allow                  ALLOW         — cross-account: identity policy partner-auditor-identity#ReadSchoolReports AND resource policy bucket-policy-reports#PartnerAuditorReads both allow
   🚫 partner auditor: bucket policy only                IMPLICIT DENY — cross-account needs BOTH sides to allow — the caller's identity policy does not
   🚫 partner auditor: identity policy only              IMPLICIT DENY — cross-account needs BOTH sides to allow — the resource policy in the other account does not
   🚫 partner auditor tries DeleteObject                 IMPLICIT DENY — cross-account needs BOTH sides to allow — the caller's identity policy does not
   two doors, two keys: the partner's account AND the school's bucket must both say yes

═══ people ═══
── IAM Identity Center: one login for people; permission sets become roles in every account
   👥 teachers-group  → permission set Teachers  → role arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Teachers_…
   👥 it-group        → permission set Admins    → role arn:aws:iam::111122223333:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Admins_…
   👥 it-group        → permission set Admins    → role arn:aws:iam::444455556666:role/aws-reserved/sso.amazonaws.com/AWSReservedSSO_Admins_…
   ✅ aishwarya via SSO (Teachers) → read a report       ALLOW         — identity policy read-reports#ReadReports allows it
   🚫 aishwarya via SSO (Teachers) → terminate EC2       IMPLICIT DENY — no policy allows it — AWS denies by default
   no IAM users for people, no long-lived keys — a leaver is disabled once, in one place

═══ leastpriv ═══
── granted: ['s3:*', 'ec2:*', 'dynamodb:*'] · actually used in 90 days: ['s3:GetObject', 's3:ListBucket', 's3:PutObject', 'ec2:DescribeInstances']
   💤 services granted but never used: ['dynamodb:*'] — remove them
   ✂️ generated policy from what was used: ["ec2:DescribeInstances", "s3:GetObject", "s3:ListBucket", "s3:PutObject"]
   ✅ narrowed policy → s3:GetObject                     ALLOW         — identity policy narrowed#0 allows it
   🚫 narrowed policy → dynamodb:DeleteTable             IMPLICIT DENY — no policy allows it — AWS denies by default
   then narrow Resource from * to the real bucket — Access Analyzer's policy generation does these steps from CloudTrail

═══ audit ═══
── the credential report (iam/data/credential-report.csv), read like an auditor
   ✅ <root_account>  fine
   ✅ aishwarya       fine
   ⚠️ katrina         password without MFA, key 329 days old
   ⚠️ dipika          password without MFA, key 931 days old, key unused > 90 days → delete
   ✅ ci-robot        fine
── CloudTrail (iam/data/cloudtrail.json): a key used from a new country at 2 a.m.
      2026-09-26T09:12:04Z katrina   GetObject         ap-south-1  203.0.113.40   
      2026-09-26T09:40:11Z katrina   ListBuckets       ap-south-1  203.0.113.40   
   🚨 2026-09-27T02:03:55Z katrina   GetCallerIdentity us-east-1   198.51.100.77  
   🚨 2026-09-27T02:04:20Z katrina   RunInstances      sa-east-1   198.51.100.77  AccessDenied
   🚨 2026-09-27T02:04:31Z katrina   CreateUser        us-east-1   198.51.100.77  AccessDenied
      2026-09-27T08:15:00Z aishwarya GetObject         ap-south-1  203.0.113.12   
   runbook: 1 deactivate AKIAEXAMPLEKATRINA01 · 2 revoke sessions · 3 look for what it created · 4 rotate · 5 find how it leaked

✅ done — every decision above came from iam/evaluate.py

🗺️ संपूर्ण चित्र — एक आकृती, पूर्ण कोर्स

संपूर्ण कोर्स एका कॅनव्हासवर. 4K आवृत्तीसाठी क्लिक करा.

🪪 भाग 1 — ओळखपत्र कार्यालय (धडे 1–6)

एक git branch = एक कल्पना; branch 04 मध्ये धडे 01–04 आहेत. प्रत्येक निर्णय iam/evaluate.py घेतो — AWS account ची गरज नाही.

🛡️ भाग 2 — ओळखपत्र कार्यालय सुरक्षितपणे चालवणे (धडे 7–12)

खऱ्या AWS accounts ना काय लागते: conditions, organization guardrails, cross-account access, single sign-on, कमीत कमी अधिकार आणि incident runbook.

📐 धड्यांच्या आकृत्या — क्रमांक अनुसरा

प्रत्येक धडा एका क्रमांकित बॉक्स-आणि-बाण आकृतीत — स्वतंत्र पानावरही.