Build a PAM Lab with AWS IAM Roles

Create a PAM sandbox with MFA-protected IAM roles and temporary access.

Introduction

30 Second Summary

Powerful account permissions can turn a routine task into a costly mistake when they stay available all day. Safer access appears only for the task that needs it, then disappears.

In this project, you will build a single-account privileged access management sandbox with AWS Identity and Access Management (IAM). You will demonstrate baseline denial, MFA-protected elevation, de-elevation, and revocation.

What You'll Build

Across two browser sessions, you can show pam-trainee hitting a denied user-creation request, switching into PAM-User-Operator to complete the scoped task, then losing privileged access after eligibility is removed.

By the end of this project, you'll have:

A console-only trainee identity with baseline read-only access that lets you inspect IAM without changing resources.
A visible least-privilege boundary where creating pam-demo-target as pam-trainee produces a denial.
A successful temporary elevation into PAM-User-Operator that lets you create only pam-demo-target before returning to baseline access.
Secret Mission: Revoke a live PAM-User-Operator session so its issued credentials lose access while the session is still open.

Are there any prerequisites?

You'll need an AWS account with root-user access protected by MFA. You'll also need a Linux computer with a working web browser, basic IAM familiarity, and an existing MFA device that can be assigned to the trainee.

Before We Start

Before any account changes, take a moment to commit to the security goal. You are giving pam-trainee temporary permission to create only pam-demo-target without granting permanent administrative access.

Create the Baseline Identity

Routine access should begin with the smallest useful permission set. Using the root user for everyday practice would hide the security boundary this lab is designed to prove.

In this step, you'll use your root session in the AWS Management Console to create a disposable identity in AWS Identity and Access Management (IAM). The trainee gets read-only console access protected by multi-factor authentication (MFA).

In this step, get ready to:

Create a baseline reader group with read-only IAM permissions.
Create the console-only trainee identity without access keys.
Register MFA for the trainee identity.

Create the baseline reader group

An IAM user group applies the same permission policy to every member. The AWS managed policy IAMReadOnlyAccess lets the trainee inspect IAM resources without creating them.

Keep Root Use Focused

Root access can feel high stakes. This step uses it only to create the lab's limited identity.

Sign in to the AWS Management Console as the root user from your Linux browser.
Use the console search to find IAM.
Select IAM from the service results.
Select User groups in the IAM sidebar.

You'll see the account's current IAM user groups.

Click Create group.
Enter PAM-Baseline-Readers in the User group name field.

The group form now carries the exact baseline group name used throughout the lab.

Search the policy list for IAMReadOnlyAccess.

The policy list narrows to the read-only IAM policy.

Select the checkbox beside IAMReadOnlyAccess.
Click Create group.

That first guardrail is in place. You'll see PAM-Baseline-Readers with IAMReadOnlyAccess attached.

Can't Find IAMReadOnlyAccess?

Clear any filters from the policy list.
Search for the full policy name IAMReadOnlyAccess.

Help me find the read-only IAM policy.

Create the console-only trainee

A console-only IAM user signs in through a browser with a password. This identity does not need programmatic credentials for any part of the lab.

Return to Users in the root IAM session.
Click Create user.

You'll see the form for defining the trainee identity.

Enter pam-trainee as the user name.
Select Provide user access to the AWS Management Console.

The console shows an additional choice for creating the user's sign-in credentials.

Select I want to create an IAM user.
Select Autogenerated password.

The trainee now has a generated initial password ready for its first console sign-in.

Keep User must create a new password at next sign-in (recommended) selected.
Continue to the permissions stage.

The permissions stage controls which baseline policy reaches the new user.

Choose the option for assigning the user to an existing group.
Select PAM-Baseline-Readers.

The creation summary now connects the trainee to the read-only group.

Complete the user creation by clicking Create user.

The generated password is a live credential. Keeping it out of screenshots protects the trainee account.

Save the generated sign-in details in a secure password manager.
Close the one-time credential display after saving the details.

The trainee identity now appears in the account with its baseline group membership.

Open pam-trainee from the Users list.
Select Security Credentials.
Inspect the access-key area for pam-trainee.

You'll see that pam-trainee has no access keys.

Why Leave Out Access Keys?

Access keys support programmatic requests. This trainee only needs AWS Management Console access, so a password plus MFA covers the lab workflow.

Missing the Baseline Group?

Return to pam-trainee in the Users list.
Confirm that PAM-Baseline-Readers appears in the user's group memberships.

Help me connect pam-trainee to the baseline group.

Register MFA and verify the trainee sign-in

MFA requires a second proof during sign-in. Most virtual MFA apps support multiple registrations, so the trainee can have a separate entry on your existing device.

Locate Multi-factor authentication (MFA) on the pam-trainee Security Credentials page from earlier.
Click Assign MFA device.
Enter pam-trainee in the Device name field.

Authenticator app

Select Authenticator app.
Continue to the device setup screen.
Click Show QR code.
Scan the QR code with your existing authenticator app.
Enter the current code in MFA code 1.
Wait for the authenticator app to generate the next code.
Enter the new code in MFA code 2.
Click Add MFA.

Another MFA device

Select the device type that matches your existing MFA device.
Follow the device's on-screen enrollment instructions.
Complete the assignment using the console confirmation control.

Your second sign-in factor is ready. The root session now shows an assigned MFA device for pam-trainee.

MFA Codes Not Accepted?

Check that your MFA device uses automatic time synchronization.
Enter two consecutive codes from the same trainee registration.
Retry the assignment with two newly generated codes.

Help me troubleshoot the trainee MFA registration.

Return to the IAM home page in the root session.
Record the account sign-in URL here: your account sign-in URL.

A private window keeps the trainee's browser session separate from the root session. That separation lets both identities stay signed in for later comparisons.

Use your browser menu to open a private browsing window.
Enter your account sign-in URL in the private window.
Enter pam-trainee as the user name.
Enter the saved temporary password.
Complete the required password change if prompted.
Enter the current MFA code when prompted.

The trainee session is now signed in with its password plus MFA. Your root session remains available in the original browser window.

Before you open IAM in the trainee session, do you expect this read-only identity to see the Users list?

Use the console search in the private trainee session to find IAM.
Select IAM from the service results.
Select Users in the IAM sidebar.

You'll see the IAM Users page with read-only identity information. This confirms that pam-trainee can sign in through its console password plus MFA.

Can't Complete the Trainee Sign-In?

Confirm that the private window uses the account sign-in URL from the root IAM session.
Enter the new password if the first sign-in required a password change.
Use the MFA entry registered specifically for pam-trainee.

Help me troubleshoot the pam-trainee console sign-in.

Your baseline identity is ready. Next, you'll test where its read-only permission boundary stops.

Test the Least-Privilege Boundary

Your pam-trainee identity now signs in to AWS Identity and Access Management (IAM) with multi-factor authentication (MFA). Its baseline permissions come from PAM-Baseline-Readers.

A privileged access management (PAM) control becomes meaningful when normal access reaches the edge of least privilege. This step tests whether read-only access can cross from inspecting IAM resources into changing them.

In this step, get ready to:

Confirm baseline inspection across the main IAM resource lists.
Test whether the trainee can create pam-demo-target.
Trace the result back to the baseline policy.

Confirm read-only inspection

The baseline should provide enough visibility to inspect IAM resources. Each resource page gives you a concrete check that the trainee can read account information.

Switch back to the private browser window from earlier.
In the IAM navigation pane, choose Users.

You'll see pam-trainee in the user list. This confirms that the trainee can inspect IAM users.

Choose User groups in the IAM navigation pane.

You'll see PAM-Baseline-Readers in the group list. This confirms that the trainee can inspect IAM user groups.

Choose Roles in the IAM navigation pane.

You'll see the account's current role list. This confirms that the trainee can inspect IAM roles.

Choose Policies in the IAM navigation pane.

You'll see a list of policies available for inspection. The four pages confirm that baseline access can read IAM resource information.

Test the create boundary

Viewing an IAM resource and creating one are separate authorization decisions. This request tests the create boundary with a harmless named target.

Choose Users in the IAM navigation pane.
Choose Create user.
Enter pam-demo-target as the new user's name.
Leave Provide user access to the AWS Management Console cleared.
Choose Next.
Leave the permission options unchanged.
Choose Next to reach the review stage.

Before you submit the request, do you think the trainee's baseline permissions can create this user?

Choose Create user to submit the request.

You'll see an access-denied result. This intended shortfall shows that the trainee has reached its authorization boundary.

Why Does the Denial Matter?

The AWS managed policy IAMReadOnlyAccess grants permission to get and list IAM resources. It does not grant resource creation or deletion.

The denied request proves that inspection access has not silently become standing privilege.

Did the User Get Created?

A successful request means another policy is granting write access. Detaching an unintended policy changes only the disposable trainee identity.

Switch back to the root session from earlier.
Review the policies attached directly to pam-trainee.
Review every policy inherited through the trainee's group memberships.
Detach any unintended policy that grants IAM user creation.
Repeat the create-boundary test from the private browser window.

Help me find the extra IAM permission.

Trace the permission boundary

The policy attachment explains why inspection succeeded while the create request failed. Reviewing that connection turns the denied request into a repeatable security check.

Choose User groups in the IAM navigation pane.
Choose PAM-Baseline-Readers.
Choose Permissions.
Select IAMReadOnlyAccess from the attached policies.

The policy details show read-only IAM permissions. This explains the visibility you confirmed across the resource pages.

Before you check the final state, do you expect the denied request to have left a user behind?

Choose Users in the IAM navigation pane.
Enter pam-demo-target in the Users page search field.

You'll see no matching user. That is the core PAM boundary working in your own account.

Your baseline boundary is now proven. Next, you'll build an MFA-protected role that provides a controlled path to the missing privilege.

Build an MFA-Protected Privileged Role

Your denied request proved that pam-trainee can inspect AWS Identity and Access Management (IAM) without changing its resources. That boundary is doing its job.

Now you'll create an MFA-protected IAM role for the missing capability. A customer managed policy limits that capability to the named demonstration user.

In this step, get ready to:

Create an MFA-protected role with read-only IAM access.
Define a scoped policy for managing only pam-demo-target.
Attach the policy to the role and inspect both controls.

Create the MFA-protected role

A trust relationship controls who may assume a role. Requiring MFA makes successful authentication a condition of role assumption.

Switch back to the root browser session from earlier.
Choose Roles in the IAM navigation pane.

You should see the account's role list with the control for creating a role.

Choose Create role.
Select AWS account as the trusted entity type.

The page now asks which AWS account can use this role.

Select This account.
Select Require MFA.

What does Require MFA do?

This option adds a trust-policy condition that checks aws:MultiFactorAuthPresent. A principal without MFA authentication cannot assume the role.

Choose Next.
Find IAMReadOnlyAccess in the Permissions policies list.

The permissions page lets you define what the role can do after the trust check succeeds.

Select the checkbox next to IAMReadOnlyAccess.
Choose Next.

The review page should show the trusted account choice with MFA required. It should also show IAMReadOnlyAccess as the selected policy.

Enter PAM-User-Operator in the Role name field.
Choose Create role.

Good progress. Your role now exists with read-only IAM permissions and an MFA-protected trust relationship.

Role creation not completing?

Confirm that AWS account is the trusted entity type.
Confirm that This account is selected.
Check that the role name is exactly PAM-User-Operator.

Help me review my IAM role creation settings.

Create the scoped permissions policy

The role still needs permission to perform the denied task. Its new policy grants user creation and deletion only when the resource is pam-demo-target.

Finding the account ID inside the longer role ARN can feel fiddly. Look for the 12-digit number in the ARN on the role summary.

Locate the account ID in the role ARN for PAM-User-Operator.
Record the account ID here: your 12-digit AWS account ID.

This value makes the policy resource belong to your AWS account.

Choose Policies in the IAM navigation pane.
Choose Create policy.

You should see the policy creation page with the policy editor.

The policy template contains an account-specific placeholder. You will replace it before AWS validates the policy.

Choose JSON in the Policy editor.
Load the policy template by replacing the editor contents with the JSON below:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ManageOnlyDemoTarget",
      "Effect": "Allow",
      "Action": [
        "iam:CreateUser",
        "iam:DeleteUser"
      ],
      "Resource": "arn:aws:iam::<ACCOUNT_ID>:user/pam-demo-target"
    }
  ]
}

What does this policy do?

The Action list permits only iam:CreateUser and iam:DeleteUser.
The Resource value limits those actions to pam-demo-target in your account.
The ManageOnlyDemoTarget statement leaves every other IAM user outside this permission.

Replace <ACCOUNT_ID> with your 12-digit AWS account ID.
Choose Next.

The review page should show two allowed actions for one user resource in your account.

Enter PAM-Target-User-Operator in the Policy Name field.
Choose Create policy.

That permission boundary is now saved. The policy can manage only the named demonstration user.

Policy not saving?

Check that you replaced <ACCOUNT_ID> with all 12 digits of your account ID.
Compare each brace and quotation mark with the policy template.
Refresh the policy list after a short wait if the new policy does not appear immediately.

Help me find the problem in my IAM policy.

Attach and inspect the policy

Permissions answer what the role can do. The trust relationship answers who can assume it under which condition.

Return to Roles in the IAM navigation pane.
Choose PAM-User-Operator from the role list.

You should see the role summary for PAM-User-Operator.

Choose the Permissions tab.
Choose Add permissions.

The permissions menu should offer a path for attaching an existing policy.

Choose Attach policies.
Select the checkbox next to PAM-Target-User-Operator.

Choose Attach policies.

Your role now combines read-only IAM visibility with one tightly scoped privileged task.

Before you inspect the finished role, do you expect its permissions and trust relationship to answer the same security question?

Confirm that the Permissions tab lists IAMReadOnlyAccess.
Confirm that the Permissions tab lists PAM-Target-User-Operator.
Choose the Trust relationships tab.
Confirm that the trust relationship requires aws:MultiFactorAuthPresent to be true.

You will see two separate controls. The permissions policies define the role's capabilities. The trust relationship requires a principal from this account to use MFA before assuming it.

Policy missing from the role?

Refresh the role page after a short wait because IAM changes can take time to propagate.
Check that you attached PAM-Target-User-Operator to the role instead of opening the policy summary.
Confirm that IAMReadOnlyAccess remains attached.

Help me verify the role's permissions and MFA condition.

Your privileged role is ready with a narrow permission boundary and an MFA gate. Next, you will make pam-trainee temporarily eligible to assume it.

Grant and Use Temporary Elevation

The role now contains the missing privileged capability. However, pam-trainee cannot use that IAM role until an administrator makes the trainee eligible to assume it.

That eligibility becomes the lab's manual approval gate. You'll grant the trainee one route into PAM-User-Operator.

The trainee will then switch into the role with an MFA-backed session that uses temporary credentials.

In this step, get ready to:

Create PAM-Assume-Role for the exact privileged role ARN.
Grant elevation eligibility through PAM-Elevation-Eligible.
Switch pam-trainee into PAM-User-Operator with temporary credentials.

Create the assume-role policy

An identity needs explicit permission to call sts:AssumeRole for a target role. The customer managed policy named PAM-Assume-Role grants that permission only for PAM-User-Operator.

This change creates a narrow route into one role. The role's own policies control what happens after the switch.

Switch back to the root browser session from earlier.
Choose Roles in the IAM navigation.
Select PAM-User-Operator.
Copy the complete role ARN into this field: complete ARN of PAM-User-Operator.
Record the account ID portion of the ARN here: your 12-digit AWS account ID.
Choose Policies in the IAM navigation.
Choose Create policy.
Choose JSON in the Policy editor.

Define the single allowed role assumption by pasting this template into the Policy editor:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AssumeOnlyPamOperatorRole",
      "Effect": "Allow",
      "Action": "sts:AssumeRole",
      "Resource": "<ROLE_ARN>"
    }
  ]
}

What does this policy do?

The Version value identifies the policy language version.
The Sid value gives the permission statement a readable name.
The sts:AssumeRole action permits a role switch.
The Resource value limits that permission to the exact role ARN.

Replace <ROLE_ARN> with complete ARN of PAM-User-Operator.
Choose Next.
Enter PAM-Assume-Role under Policy Name.
Choose Create policy.
Confirm PAM-Assume-Role appears under Policies.

Good progress. The account now has an eligibility policy scoped to one privileged role.

Policy missing from the list?

Confirm that the Resource value contains the complete ARN of PAM-User-Operator.
Check that the policy name is exactly PAM-Assume-Role.
Reopen the policy editor if the policy document was not accepted.

Help me check my assume-role policy.

Make the trainee eligible

Membership in PAM-Elevation-Eligible represents the administrator's approval gate. The group carries only the permission needed to assume PAM-User-Operator.

Choose User groups in the IAM navigation.
Choose Create group.
Enter PAM-Elevation-Eligible under User group name.
Select pam-trainee from the user list.
Select PAM-Assume-Role from the permissions policy list.
Choose Create group.
Open PAM-Elevation-Eligible from the user groups list.

You'll see pam-trainee listed as a member. You'll also see PAM-Assume-Role attached to the group.

That's the approval gate in place. The trainee can now request a temporary privileged session.

Missing the user or policy?

Confirm that you selected pam-trainee while creating the group.
Confirm that PAM-Assume-Role appears in the group's attached permissions.
Add the missing member or policy before continuing.

Help me check this eligibility group.

Switch into the privileged role

A role switch asks AWS STS to issue temporary security credentials for PAM-User-Operator. The console uses the role's permissions for the new session.

Your MFA-authenticated sign-in satisfies the role's trust condition. The new eligibility policy authorizes the switch to this exact role.

Return to the private browser window from earlier.
Open the user menu in the AWS Management Console navigation bar.
Choose Add session if Switch role is not displayed.
Choose Switch role.
Enter your 12-digit AWS account ID in the account field.
Enter PAM-User-Operator as the role name.
Enter PAM-Elevated as the optional Display name.
Select a clear Display color for the role session.

Before you switch, which identity do you expect the console navigation bar to show?

Choose Switch Role.

You'll see PAM-Elevated with your selected color in the console navigation bar. This confirms that the temporary role session is active.

What changed in this session?

The role session uses the permissions attached to PAM-User-Operator.
The role can inspect IAM through IAMReadOnlyAccess.
The role can create or delete only pam-demo-target through PAM-Target-User-Operator.
Choosing Switch back later restores the trainee's baseline session.

You have crossed the elevation boundary successfully. pam-trainee is now operating with temporary role credentials.

Role switch denied?

Return to the root session to confirm that pam-trainee belongs to PAM-Elevation-Eligible.
Confirm that PAM-Assume-Role is attached to the eligibility group.
Confirm that the policy targets the complete ARN of PAM-User-Operator.
Retry the switch after IAM finishes propagating the new permissions.

Help me diagnose this role switch.

Your elevated session is ready. Next up, you'll use its scoped permission on pam-demo-target. Then you'll remove eligibility to close the route.

Revoke Eligibility and Verify Denial

Your MFA-backed AWS STS role session is active in IAM. It has exactly enough permission to create the named demonstration user.

Permanent eligibility recreates standing privilege. Removing the trainee from the eligibility group closes the route to future privileged sessions.

In this step, get ready to:

Create pam-demo-target during the current privileged session.
Return to the pam-trainee baseline session.
Revoke pam-trainee's eligibility to make a new role switch fail.

Create the scoped target user

The active PAM-User-Operator session can create only pam-demo-target. This is the privileged task that justifies temporary elevation.

In the private browser window, choose Users from the IAM navigation pane.
Choose Create user.

You'll see the form for defining the new IAM user.

Enter pam-demo-target as the user name.
Leave Provide user access to the AWS Management Console unchecked.

The form now identifies the permitted target. Console access remains disabled.

Continue to the permissions stage by choosing Next.

You'll see that no permissions are selected for the new user.

Continue without attaching permissions by choosing Next.

The review shows pam-demo-target without console access or attached permissions.

Create the target user by choosing Create user.

You'll see pam-demo-target in the Users list. That is the privileged task complete.

Creation denied in the role session?

Check that the navigation bar still shows your role display name. Confirm that the user name is exactly pam-demo-target.

Verify that PAM-Target-User-Operator remains attached to PAM-User-Operator in the root session.

Help me diagnose why the elevated role cannot create the permitted IAM user.

Switch back and remove eligibility

Switching back restores the baseline permissions of pam-trainee. Removing its group membership takes away permission to request a fresh privileged role session.

In the private browser window, choose the role display menu in the navigation bar.
Choose Switch back.

You'll see pam-trainee in the navigation bar instead of the role display name. The private window is using baseline credentials again.

Switch to the root browser window.
Return to the IAM page from earlier.

The root session still has administrator control over the lab identities.

Choose User groups from the navigation pane.
Choose PAM-Elevation-Eligible.

You'll see the group details page for the lab's manual eligibility gate.

Choose the Users tab.
Select the checkbox next to pam-trainee.
Choose Remove users.

You'll see that the Users tab no longer lists pam-trainee. The group still retains PAM-Assume-Role.

The approval gate is now closed. pam-trainee no longer receives permission to call sts:AssumeRole through the eligibility group.

Still see the trainee in the group?

Confirm that you are viewing PAM-Elevation-Eligible in the root browser window. Refresh the Users tab after completing the removal.

Help me remove pam-trainee from the eligibility group.

Verify new elevation is denied

Authentication through MFA is still intact. Authorization for sts:AssumeRole has been removed from the trainee's permission path.

Return to the private browser window with the pam-trainee session.
Choose the user menu in the navigation bar.

The menu confirms that the private window is using the baseline user session.

Choose Switch role.

You'll see the same role-switch form that previously accepted the elevation request.

Enter the same account ID you used for the earlier role switch.
Enter PAM-User-Operator as the role name.

Before you make the request, ask yourself whether MFA will be enough after the permission path is removed.

Submit the new elevation request by choosing Switch Role.

You'll see that the role switch is denied. This is the intended result because pam-trainee no longer receives PAM-Assume-Role.

Did the role switch succeed?

Choose Switch back immediately.
Confirm that the Users tab for PAM-Elevation-Eligible no longer lists pam-trainee.
Retry the role switch after IAM recognizes the membership change.

Help me find why pam-trainee can still assume the role after eligibility removal.

The denied elevation should leave baseline read-only access untouched. One final check separates de-elevation from a broken sign-in.

Return to IAM in the same private browser window.
Choose Users from the navigation pane.

You'll see the Users page load with pam-demo-target in the list. The ability to inspect it confirms that IAMReadOnlyAccess still applies.

You've completed the core PAM lifecycle. You used temporary privilege for one scoped task before closing the route to future elevation.

Secret mission

Revoke a Live Privileged Session

Eligibility removal blocks the next elevation. This challenge targets credentials that were already issued. You will revoke the live PAM-User-Operator session to make IAM deny its older temporary credentials.

Clean Up Your Resources

There is no charge to use AWS Identity and Access Management (IAM). Choose whether to keep the lab, pause trainee access, or delete every resource.

Resources you used:

Console-only IAM user pam-trainee with an assigned MFA device.
IAM user pam-demo-target without console access.
IAM user group PAM-Baseline-Readers with IAMReadOnlyAccess attached.
IAM user group PAM-Elevation-Eligible with PAM-Assume-Role attached.
Customer managed IAM policy PAM-Target-User-Operator.
Customer managed IAM policy PAM-Assume-Role.
MFA-protected IAM role PAM-User-Operator.
Inline policy AWSRevokeOlderSessions attached to PAM-User-Operator.

Keep everything running

Keep every named IAM resource if this is a dedicated sandbox account. IAM does not charge for retaining these resources.

Leave pam-trainee outside PAM-Elevation-Eligible to prevent new privileged sessions.
Sign out of the root-user session when you finish using the lab.
Close the private browser window to end the trainee browser sessions.

Pause - I'll come back to this later

Pause the lab by removing the trainee's remaining baseline membership. The trainee is already outside PAM-Elevation-Eligible.

Return to the root-user IAM session from earlier.
Select User groups in the IAM navigation.
Select PAM-Baseline-Readers.
Remove pam-trainee from the group membership.
Confirm that pam-trainee no longer appears in the group's member list.
Sign out of the root-user session.
Close the private browser window.

The trainee remains available for a later practice session. Neither lab group currently grants it permissions.

Delete - I don't want to use this again

Remove every IAM resource created for the lab. This returns the account to its pre-project state.

This Cleanup Is Permanent

Deleting these IAM resources is permanent. Your AWS account stays available because every action below targets only the named lab resources.

Delete the IAM users first:

Return to the root-user IAM session from earlier.
Select Users in the IAM navigation.
Select pam-demo-target.
Use the delete action on the pam-demo-target details page.
Complete the confirmation IAM displays.

The pam-demo-target user no longer appears in the Users list.

Return to Users.
Select pam-trainee.
Use the delete action on the pam-trainee details page.
Complete the confirmation IAM displays.

IAM removes the trainee's console password. IAM also removes its MFA association and remaining group memberships.

Delete the IAM user groups next:

Select User groups in the IAM navigation.
Select PAM-Baseline-Readers.
Use the delete action on the group details page.
Complete the confirmation IAM displays.

The PAM-Baseline-Readers group no longer appears in the User groups list.

Return to User groups.
Select PAM-Elevation-Eligible.
Use the delete action on the group details page.
Complete the confirmation IAM displays.

Deleting these groups detaches their managed policies. The AWS managed IAMReadOnlyAccess policy remains available in the account.

Delete the privileged IAM role:

Select Roles in the IAM navigation.
Select PAM-User-Operator.
Use the delete action on the role details page.
Complete the confirmation IAM displays.

IAM detaches the role's managed policies during deletion. IAM also deletes the inline AWSRevokeOlderSessions policy.

Delete the customer managed policies last:

Select Policies in the IAM navigation.
Select PAM-Target-User-Operator.
Choose Actions.
Choose Delete.
Complete the confirmation IAM displays.

The first customer managed policy is now removed.

Return to Policies.
Select PAM-Assume-Role.
Choose Actions.
Choose Delete.
Complete the confirmation IAM displays.
Sign out of the root-user session.
Close the private browser window.

That completes the teardown. The lab users, groups, customer managed policies, privileged role, and revocation policy are gone.

Nice Work!

Congratulations! You completed a working privileged access management lab in AWS Identity and Access Management (IAM). Your trainee demonstrated baseline denial followed by MFA-protected temporary access through AWS Security Token Service (AWS STS).

What you learned:

Established a least-privilege baseline for pam-trainee through PAM-Baseline-Readers with IAMReadOnlyAccess.
Created a scoped privileged role named PAM-User-Operator that can manage only pam-demo-target.
Used temporary elevation to create pam-demo-target. Removed eligibility to prove that a new privileged session was denied.
Secret Mission: Revoked an active PAM-User-Operator session with AWSRevokeOlderSessions. Confirmed that its older temporary credentials lost access.

Ready to quiz yourself?