Home > Hands-On Labs > Lab
Comments
What's a Hands-On Lab?
1-Click Deployments
AWS lab environments at the click of a button. Skip the hassle of creating or managing practice accounts and dive straight into using real resources.
Practical Learning
Learn cloud security with real AWS resources and real-world scenarios, not just theory.
Risk Free
No surprise bills when you forget to delete learning resources, and keep vulnerable training environments safely isolated from your corporate and production resources.
Responses
I really liked it. I didn’t know about this tool.
Really helpful tool that I just discovered as well! More labs coming on it.
Just tried it and it didn’t work for me, have been declined access,
Failed to assume role: An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:iam::350973243370:user/Daniel is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::762620608760:role/S3AccessImages
Traceback (most recent call last):
File “/mnt/c/Users/xxxxxxx/conditional-love/./conditional-love.py”, line 217, in
main(args)
File “/mnt/c/Users/xxxxx/conditional-love/./conditional-love.py”, line 31, in main
if not can_access_target_with_policy(base_session, args.role, args.target, args.action, None, args.region):
File “/mnt/c/Users/xxxxx/conditional-love/./conditional-love.py”, line 94, in can_access_target_with_policy
client = assumed_role_session.client(service_name)
AttributeError: ‘NoneType’ object has no attribute ‘client’
Hey, did you launch the lab a couple of different times? Asking because you’re attempting to use a user from account ID 350x while attempting to assume a role from account ID 762x, so I’m assuming you simply forgot to retrieve the new user or role ARN when issuing your commands the second time around. Both the user and role account numbers should match since they are both in the same account and values can’t be re-used between lab launches
Hey, I faced similar issue. I presume that you copied the command from the instructions with wrong account ID (762620608760) – actually this needs to be replaced with your current account ID – in your case it was 350x. To get the account ID according to the instructions you want to run `aws iam list-roles –query “Roles[?RoleName==’S3AccessImages’]”` command and “Grab the ARN value and store it in your notes because we’ll need it in just a minute” (ofc there are other ways too). This ARN you’ll use when running the script.
Thanks Toom! I made the sentence bold in the walkthrough guide so that it’s more visible
Enjoyed the lab!