Hands-On Lab
Log in or create a free account to launch this lab.
Log in or create a free account to launch this lab.
Please confirm you want to block this member.
You will no longer be able to:
Please allow a few minutes for this process to complete.
Please look into the certificate of completion it has some issue…it does not contain our name in it.
Hey you just need to fill in your name in your account profile for the certificate system to know what to put into that field. Go to your account -> profile -> details -> edit
Is it okay to install AWS CLI on company laptop , once we give access key it will navigate to CYBR account is that my understanding Correct??
This is a question for your company’s IT department to answer as they may have policies against downloading unapproved software. But yes, once you pass in the lab’s credentials, you will be authenticating into a Cybr AWS account instead of your own
1. What is diffrence between user root and the IAM user having Administrive permisions
2. Whats the diffrence between Power user Policy and Administrive permisions policy
1. Root is the highest privilege user, whereas admin permissions is the 2nd highest. It has almost as many permissions as root, minus a few actions. See tasks that require root user credentials. In practical terms: if an admin user gets compromised, you can still access root to regain control of your account, but if root user gets compromised, you will have to contact AWS and prove you are the rightful owner to regain access to your account.
2. Check out the docs for both managed policies: PowerUserAccess vs. AdministrativeAccess to view the exact differences
May i know the diffrence between creating user through IAM vs creating user through IAM identity center
This is a tough question to answer in a quick comment like this, so I’d recommend checking out this lesson as a starting point (it’s free): https://cybr.com/courses/aws-certified-security-specialty-scs-c02-course/lessons/iam-users-vs-identity-center-users/
That was a pretty good introduction! I think you could improve it by making two changes
When introducing the assume-role action, make it clear that there are two main methods assuming a role using credentials from a file (which you already demonstrated), and assuming a role directly using the AWS CLI. I appreciate that you showed how to do the file method, but it would help to also walk through the CLI method using
aws sts assume-role –role-arn arn:aws:iam:::role/ –role-session-name –profile
For the part about roles, I think it would flow better if you first showed how to list the available roles using
aws iam list-roles –profile
and then demonstrated how to filter or select the specific role to assume.
im having trouble. ive attempted multiple times and now have three different profiles cached in the CLI. i cannot get past assuming a role for my account. it gives me an unknown output [a] error.
i have my output set to default. i think one of the cached configs has a bad default set thats causing the problem?
ive tried clearing the cache with command aws sso logout tried deleting through ~/.aws/crednetials but nothing seems to get rid of the old configs, please help
Hey, this particular lab doesn’t use aws sso or any SSO-based authentication, so you’re likely mixing configurations from another environment. I would recommend starting from a clean slate unless you need to keep SSO credentials for your work. To be safe, instead of deleting files, can move them for backup purposes:
mv ~/.aws/config ~/.aws/config.backup
mv ~/.aws/credentials ~/.aws/credentials.backup
Once you’ve done that, please follow the lab guide step-by-step and do not deviate until you get this working properly. If you still encounter an error, please copy/paste it so we can take a look and troubleshoot.
when you say you recommend starting from a clean slate how do i do that. if i terminate my lab and my cli and start over the configs are still in there. tried googling how to clear all old configs and sso logout was only thing i could find. is there a different command that will allow me to “start from a clean slate”
The commands I shared in my prior response is what I meant to use to start from a clean slate. Your AWS CLI credentials/configurations are primarily stored in ~/.aws/config and ~/.aws/credentials, so by running those commands and then going through the lab guide, you will be good to go.
i see sorry for the confusion i guess i was hung up with what the command would be to clear the configs not just send to a backup. regardless still can get to backup/ clear with these commands,,, i get permission denied
Last login: Sun Jun 1 20:25:25 on ttys000
ghive@Mac ~ % ~/.aws/config
zsh: permission denied: /Users/ghive/.aws/config
ghive@Mac ~ % ~/.aws/config ~/.aws/config.backup
zsh: permission denied: /Users/ghive/.aws/config
ghive@Mac ~ % ~/.aws/config.backup
zsh: no such file or directory: /Users/ghive/.aws/config.backup
ghive@Mac ~ % aws –version
aws-cli/2.27.26 Python/3.13.3 Darwin/24.2.0 exe/x86_64
ghive@Mac ~ %
You are leaving off the “mv” part of the command. It’s very important that you run the commands exactly as I typed them. This one first:
mv ~/.aws/config ~/.aws/config.backup
Then this one:
mv ~/.aws/credentials ~/.aws/credentials.backup
that did it, got through with no other problems thank you christophe
Cool, glad it worked!
I had fun
aws iam create-user –user-name 178
aws: [ERROR]: An error occurred (InvalidClientTokenId) when calling the CreateUser operation: The security token included in the request is invalid.
Let me know what I am missing, or how do fix it. Thanks
aws –version
aws-cli/2.34.32 Python/3.14.4 Darwin/25.4.0 exe/arm64
aws configure
AWS Access Key ID [****************G6OI]:
AWS Secret Access Key [****************wLDy]:
Default region name [us-east-1]:
Default output format [json]:
I’ve updated the lab guide to make it more clear that the create-user action was just an example explaining how/why you would use the CLI. The actual commands to run start later in the guide, but I can see how that would be confusing! You’re getting this access denied error because you haven’t yet configured our lab’s credentials in your CLI. Please review the lab guide again and it should make more sense now!
How can i get the PowerShell command because the commands above works well with SEED LAB not windows.
PowerShell is definitely different. My recommendation would be to use an LLM (Claude or ChatGPT) to help you translate these commands into PowerShell while you’re getting the hang of it. It’s very good at doing that. Of course, you can also go through AWS’ documentation to help with this.
nice , very good lab
thanks! Glad you liked it