LeastPrivilegePlaybook
A plain-English playbook generator that turns an AWS Academy or vendor-locked account into a step-by-step 'here's how to scope down access when you can't edit IAM' guide — starting from the calling role and producing ready-to-paste Terraform snippets for Secrets Manager, S3 and KMS that work around the immovable identity policy.
Cloud engineers and students bootstrapping real workloads in AWS Academy or vendor-managed sandboxes
- Account-context detector that reads your sts get-caller-identity and identifies LabRole / vendor roles automatically
- Per-service recipe generator: Secrets Manager, S3 buckets, KMS keys, DynamoDB tables — each with a resource-based policy that compensates for the broad identity policy
- Copy-paste Terraform modules with the LabRole ARN filled in dynamically
- Companion test script that proves the deny actually denies and the allow actually allows
The HN article opens by noting this exact situation is more common than people think — students and vendor-onboarded engineers routinely hit it and have no playbook.
The pain is real and documented — Stack Overflow confirms AWS Academy students hit the hard 'voclabs cannot create IAM' limit, and DeepWiki shows it breaks standard CDK/Terraform bootstrap flows; but the triggering HN post only scored 18 points with 0 comments, indicating modest rather than viral demand.AWS Academy Learner Lab Constraints | wongcyrus/aws-cdk-hack-for-aws-academy-learner-lab ↗
General least-privilege tools exist (Policy Sentry, AirIAM, IAM Zero, Access Undenied, AWS IAM Access Analyzer) but they all assume you can edit IAM; the very specific 'you cannot touch the identity policy at all' niche is sparsely served — the reference article is essentially the only playbook of its kind.Policy Sentry — AWS IAM Least Privilege Policy Generator ↗AWS Secrets Manager Terraform: Least-Privilege Access ↗
Target users are AWS Academy students and bootstrapping cloud engineers with very low willingness to pay; the dominant alternatives (Policy Sentry, AirIAM, iam-least-privilege-analyzer) are free/open-source, and the reference playbook itself is a free blog post, not a paid product.GitHub - iam-least-privilege-analyzer (free OSS alternative) ↗AWS Secrets Manager Terraform: Least-Privilege Access (free playbook) ↗
The constraint is structural and by design — AWS Academy and vendor-managed sandboxes deliberately lock IAM for safety, and the dual-layer (identity + resource policy) AWS pattern is a long-standing primitive, so the problem will persist as long as those environments exist.AWS Academy Learner Lab Constraints ↗SEC03-BP02 Grant least privilege access - AWS Well-Architected Framework ↗
Buildable as a code-gen service: detect caller role via STS, then emit template-able Terraform for aws_secretsmanager_secret_policy, S3 bucket policies, and KMS key policies — well-documented AWS resource-policy syntax and a narrow 3-service scope keep it tractable.Terraform Registry: terraform-aws-modules/secrets-manager/aws ↗Techniques for writing least privilege IAM policies | AWS Security Blog ↗