--- title: "AWS IAM Hands-On Labs for Cloud Security | Cybr" description: "Practice AWS IAM security with hands-on labs. Enumerate identities, review policies, build roles, exploit permissions, and start for free." url: https://cybr.com/hands-on-labs/iam/ --- Practice identity security on AWS # AWS IAM Hands-On Labs Learn AWS Identity and Access Management by working with real cloud resources. Practice discovery, policy review, secure roles, privilege escalation, and defense. [Start a free IAM lab →](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) No credit card required ![AWS IAM privilege escalation hands-on labs](https://media.cybr.com/2023/11/iam-privesc-banner-scaled.jpeg) ![Johnny Endrihs](https://media.cybr.com/2025/12/johnny-endrihs.jpg)![Christopher](https://media.cybr.com/2023/09/christopher-krisnd.jpeg)![Rafael Martinez](https://media.cybr.com/2024/02/rafael-martinez.jpeg)![Lixin Zhang](https://media.cybr.com/2023/07/lixin-zhang.jpeg)![Karan Thakkar](https://media.cybr.com/2025/11/karan-thakkar.png) **80,000+** people learn with Cybr - Real IAM resources - Guided and CTF labs - No cloud bill ![Cisco](https://cybr.comhttps//media.cybr.com/2026/08/cisco-light-360.png)![Verizon](https://cybr.comhttps//media.cybr.com/2026/08/verizon-light-360.png)![Toyota](https://cybr.comhttps//media.cybr.com/2026/08/toyota-light-360.png)![Check Point](https://cybr.comhttps//media.cybr.com/2026/08/checkpoint-light-360.png)![Moody’s](https://cybr.comhttps//media.cybr.com/2026/08/moodys-light-360.png)![AT&T](https://cybr.comhttps//media.cybr.com/2026/08/att-light-360.png)![Virginia Tech](https://cybr.comhttps//media.cybr.com/2026/08/virginiatech-light-360.png) Choose a featured IAM lab ## Practice AWS identity attacks and defenses Begin with IAM discovery, credentials reports, or a privilege escalation lab. Then build secure roles and solve advanced attack challenges. 1. Free Free beginner lab ### Introduction to AWS IAM Enumeration Find IAM users, groups, roles, and policies in a guided AWS environment. Open lab [Introduction to AWS IAM Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) 2. Free Free defensive lab ### Generate IAM Credentials Reports Create an IAM credentials report and use it to review account access. Open lab [Generate IAM Credentials Reports](https://cybr.com/hands-on-labs/lab/generate-iam-credentials-reports/) 3. Premium Secure role design ### Create an IAM Role for Secure S3 Access Create and assume an IAM role with controlled access to Amazon S3. Open lab [Create an IAM Role for Secure S3 Access](https://cybr.com/hands-on-labs/lab/create-an-iam-role-for-secure-s3-access/) 4. Free Free attack lab ### IAM CreateAccessKey PrivEsc Exploit the CreateAccessKey permission to gain access as another IAM user. Open lab [IAM CreateAccessKey PrivEsc](https://cybr.com/hands-on-labs/lab/iam-createaccesskey-privesc/) 5. Premium Advanced challenge ### IAM Challenge – Secrets Unleashed Follow an IAM attack path and use the access that you gain to retrieve a secret. Open lab [IAM Challenge – Secrets Unleashed](https://cybr.com/hands-on-labs/lab/iam-challenge-secrets-unleashed/) [Browse the complete lab catalog](https://cybr.com/hands-on-labs/) AWS IAM security topics ## Build practical identity and access skills The IAM collection covers identity discovery, credentials reports, roles, policy checks, common privilege escalation methods, and advanced challenges. ### Understand IAM identities and access Find identities, inspect permissions, and use credentials reports to review access across an AWS account. - [Introduction to AWS IAM Enumeration](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) - [Generate IAM Credentials Reports](https://cybr.com/hands-on-labs/lab/generate-iam-credentials-reports/) - [Query IAM Credentials Reports with Steampipe](https://cybr.com/hands-on-labs/lab/query-iam-credentials-reports-with-steampipe/) ### Build roles and review policies Create controlled access, build IAM resources with Terraform, and catch risky policy changes before deployment. - [Create an IAM Role for Secure S3 Access](https://cybr.com/hands-on-labs/lab/create-an-iam-role-for-secure-s3-access/) - [Building an SSM Module and IAM Role in Terraform](https://cybr.com/hands-on-labs/lab/building-an-ssm-module-and-iam-role-in-terraform/) - [Check Policies for New Access with IAM Access Analyzer](https://cybr.com/hands-on-labs/lab/check-policies-for-new-access-before-deployment-with-iam-access-analyzer/) - [Check IAM Policies Against a Deny List](https://cybr.com/hands-on-labs/lab/check-iam-policies-against-a-deny-list-with-iam-access-analyzer/) ### Change IAM user credentials See how unsafe permissions let an attacker create access keys or change console login profiles. - [IAM CreateAccessKey PrivEsc](https://cybr.com/hands-on-labs/lab/iam-createaccesskey-privesc/) - [IAM CreateLoginProfile PrivEsc](https://cybr.com/hands-on-labs/lab/iam-createloginprofile-privesc/) - [IAM UpdateLoginProfile PrivEsc](https://cybr.com/hands-on-labs/lab/iam-updateloginprofile-privesc/) ### Escalate through users and groups Join stronger groups or attach managed and inline policies to identities that an attacker controls. - [IAM AddUserToGroup PrivEsc](https://cybr.com/hands-on-labs/lab/iam-addusertogroup-privesc/) - [IAM AttachUserPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachuserpolicy-privesc/) - [IAM AttachGroupPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachgrouppolicy-privesc/) - [IAM PutUserPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putuserpolicy-privesc/) - [IAM PutGroupPolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putgrouppolicy-privesc/) ### Exploit roles and policy versions Practice attacks that change role permissions or restore a stronger version of an IAM policy. - [Privilege Escalation via IAM Versions](https://cybr.com/hands-on-labs/lab/privilege-escalation-via-iam-versions/) - [IAM AttachRolePolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-attachrolepolicy-privesc/) - [IAM PutRolePolicy PrivEsc](https://cybr.com/hands-on-labs/lab/iam-putrolepolicy-privesc/) ### Solve advanced IAM challenges Combine identity discovery and privilege escalation skills to reach protected data in realistic scenarios. - [IAM Challenge - Secrets Unleashed](https://cybr.com/hands-on-labs/lab/iam-challenge-secrets-unleashed/) - [IAM Challenge - Escape Room](https://cybr.com/hands-on-labs/lab/iam-challenge-escape-room/) Free cheat sheets ## IAM cheat sheets for policies, access, and incident response References for AWS permissions, access-control policies, workforce identity, and responding to exposed credentials. - [AWS IAM policy anatomy cheat sheet](https://cybr.com/cheat-sheets/iam-policy-anatomy/) Review Effect, Action, Resource, Condition, and Principal, with examples of role trust and cross-account access. - [S3 bucket policies vs. ACLs vs. IAM policies](https://cybr.com/cheat-sheets/s3-access-control/) Compare identity-based and resource-based access, including the scope and permissions of IAM policies, bucket policies, and ACLs. - [IAM credential exposure incident response playbook](https://cybr.com/cheat-sheets/iam-credential-exposure/) Analysis, containment, eradication, and recovery guidance for exposed or exploited AWS access keys. - [AWS IAM Identity Center cheat sheet](https://cybr.com/cheat-sheets/identity-center/) Extend your IAM foundations with workforce single sign-on, permission sets, and temporary credentials. [Browse all cloud security cheat sheets](https://cybr.com/cheat-sheets/) How the labs work ## Practice IAM security without using your AWS account Cybr prepares the AWS environment for each lab. You can focus on identity security instead of account setup, billing, and cleanup. 1. Step 01 ### Choose an IAM lab Start free or choose a premium lab that matches your experience. 2. Step 02 ### Launch the environment Get the AWS identities, policies, resources, and instructions that the lab requires. 3. Step 03 ### Complete the scenario Inspect, exploit, or secure the IAM environment and review the result. **Isolated AWS training environments** Practice without changing personal or company resources. Cybr provides the lab environment and covers its AWS costs. Continue with a structured path ## Learn AWS IAM privilege escalation step by step Build IAM knowledge from enumeration through common attack methods, then use several skills in realistic challenges. - [AWS IAM Privilege Escalation](https://cybr.com/learning-path/aws-iam-privilege-escalation-learning-path/) Follow a focused path through IAM enumeration, unsafe permissions, attack methods, and advanced challenges. Go deeper with IAM training ## Connect individual labs with complete IAM courses The IAM privilege escalation course groups attack labs into one sequence. The IAM roles course explains trust, permissions, and service access. [View the IAM privilege escalation course →](https://cybr.com/courses/iam-privilege-escalation-labs/) [View the IAM roles course](https://cybr.com/courses/practical-guide-to-aws-iam-roles/) Before you start ## AWS IAM hands-on lab FAQ Can I try an AWS IAM lab for free? Yes. Selected IAM labs are free. Create a free account and start without a credit card. [Start a free IAM lab](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) Do I need my own AWS account? No. Cybr supplies the AWS environment and lab access. Your personal and company AWS accounts stay separate. How much AWS IAM experience do I need? Beginners can start with IAM enumeration and credentials reports. Later labs cover policy review, privilege escalation, and advanced challenges. What IAM security skills can I practice? Labs cover identity discovery, credentials reports, roles, policy checks, access keys, login profiles, groups, managed policies, inline policies, and policy versions. Will AWS charge me for IAM lab resources? No. Cybr provides the AWS environment, covers its cloud costs, and removes the lab resources after your session. ## Start an AWS IAM security lab for free Enumerate IAM identities in a guided AWS environment, then continue through policy, attack, and defense scenarios. [Start a free IAM lab →](https://cybr.com/hands-on-labs/lab/introduction-to-aws-iam-enumeration/) [Explore all AWS hands-on labs](https://cybr.com/hands-on-labs/aws/) No credit card required