Understand IAM identities and access
Find identities, inspect permissions, and use credentials reports to review access across an AWS account.
Practice identity security on AWS
AWS IAM Hands-On Labs
Learn AWS Identity and Access Management by working with real cloud resources. Practice discovery, policy review, secure roles, privilege escalation, and defense.
No credit card required
70,000+ people learn with Cybr
- Real IAM resources
- Guided and CTF labs
- No cloud bill
Choose a featured IAM lab
Practice AWS identity attacks and defenses
Begin with IAM discovery, credentials reports, or a privilege escalation lab. Then build secure roles and solve advanced attack challenges.
FreeFree beginner labIntroduction to AWS IAM Enumeration
Find IAM users, groups, roles, and policies in a guided AWS environment.
Open lab
FreeFree defensive labGenerate IAM Credentials Reports
Create an IAM credentials report and use it to review account access.
Open lab
PremiumSecure role designCreate an IAM Role for Secure S3 Access
Create and assume an IAM role with controlled access to Amazon S3.
Open lab
FreeFree attack labIAM CreateAccessKey PrivEsc
Exploit the CreateAccessKey permission to gain access as another IAM user.
Open lab
PremiumAdvanced challengeIAM Challenge – Secrets Unleashed
Follow an IAM attack path and use the access that you gain to retrieve a secret.
Open lab
AWS IAM security topics
Build practical identity and access skills
The IAM collection covers identity discovery, credentials reports, roles, policy checks, common privilege escalation methods, and advanced challenges.
Build roles and review policies
Create controlled access, build IAM resources with Terraform, and catch risky policy changes before deployment.
Change IAM user credentials
See how unsafe permissions let an attacker create access keys or change console login profiles.
Escalate through users and groups
Join stronger groups or attach managed and inline policies to identities that an attacker controls.
Exploit roles and policy versions
Practice attacks that change role permissions or restore a stronger version of an IAM policy.
Solve advanced IAM challenges
Combine identity discovery and privilege escalation skills to reach protected data in realistic scenarios.
Free cheat sheets
IAM cheat sheets for policies, access, and incident response
References for AWS permissions, access-control policies, workforce identity, and responding to exposed credentials.
- AWS IAM policy anatomy cheat sheet
Review Effect, Action, Resource, Condition, and Principal, with examples of role trust and cross-account access.
- S3 bucket policies vs. ACLs vs. IAM policies
Compare identity-based and resource-based access, including the scope and permissions of IAM policies, bucket policies, and ACLs.
- IAM credential exposure incident response playbook
Analysis, containment, eradication, and recovery guidance for exposed or exploited AWS access keys.
- AWS IAM Identity Center cheat sheet
Extend your IAM foundations with workforce single sign-on, permission sets, and temporary credentials.
How the labs work
Practice IAM security without using your AWS account
Cybr prepares the AWS environment for each lab. You can focus on identity security instead of account setup, billing, and cleanup.
- Step 01
Choose an IAM lab
Start free or choose a premium lab that matches your experience.
- Step 02
Launch the environment
Get the AWS identities, policies, resources, and instructions that the lab requires.
- Step 03
Complete the scenario
Inspect, exploit, or secure the IAM environment and review the result.
Isolated AWS training environments
Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs.
Continue with a structured path
Learn AWS IAM privilege escalation step by step
Build IAM knowledge from enumeration through common attack methods, then use several skills in realistic challenges.
- AWS IAM Privilege Escalation
Follow a focused path through IAM enumeration, unsafe permissions, attack methods, and advanced challenges.
Before you start
AWS IAM hands-on lab FAQ
Can I try an AWS IAM lab for free?
Yes. Selected IAM labs are free. Create a free account and start without a credit card. Start a free IAM lab
Do I need my own AWS account?
No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate.
How much AWS IAM experience do I need?
Beginners can start with IAM enumeration and credentials reports. Later labs cover policy review, privilege escalation, and advanced challenges.
What IAM security skills can I practice?
Labs cover identity discovery, credentials reports, roles, policy checks, access keys, login profiles, groups, managed policies, inline policies, and policy versions.
Will AWS charge me for IAM lab resources?
No. Cybr provides the AWS environment, covers its cloud costs, and removes the lab resources after your session.
Start an AWS IAM security lab for free
Enumerate IAM identities in a guided AWS environment, then continue through policy, attack, and defense scenarios.
No credit card required