From 1088387fd8fbadddb4c296b48a89803be4f5a151 Mon Sep 17 00:00:00 2001 From: Chris Date: Sun, 8 Nov 2026 12:14:10 -0500 Subject: [PATCH] Labs show the bucket and role they rely on The account-hardening access-analyzer step put a policy on a bucket its commands never created (and that Block Public Access would refuse), and the machine-identity ABAC step put a policy on a role its commands never created. Both now show the create lines, so a learner pasting them doesn't hit not found. Co-Authored-By: Claude Opus 5.5 --- dashboard/labs/iam_account_hardening_labs.py | 2 ++ dashboard/labs/iam_machine_identity_labs.py | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/dashboard/labs/iam_account_hardening_labs.py b/dashboard/labs/iam_account_hardening_labs.py index 30f07b2..8f423f2 100644 --- a/dashboard/labs/iam_account_hardening_labs.py +++ b/dashboard/labs/iam_account_hardening_labs.py @@ -132,6 +132,8 @@ ) ANALYZER_COMMAND = ( f'aws accessanalyzer create-analyzer --analyzer-name {ANALYZER} --type ACCOUNT\n' + f'aws s3api create-bucket --bucket {SHARED_BUCKET}\n' + f'aws s3api delete-public-access-block --bucket {SHARED_BUCKET} # so a public policy can be saved\n' f'aws s3api put-bucket-policy --bucket {SHARED_BUCKET} --policy file://public-read.json\n' f'aws iam create-role --role-name {PARTNER_ROLE} --assume-role-policy-document file://partner-trust.json\n' 'aws accessanalyzer list-findings --analyzer-arn ' diff --git a/dashboard/labs/iam_machine_identity_labs.py b/dashboard/labs/iam_machine_identity_labs.py index 675b1ee..0f13e3d 100644 --- a/dashboard/labs/iam_machine_identity_labs.py +++ b/dashboard/labs/iam_machine_identity_labs.py @@ -246,7 +246,9 @@ def handler(event, context): ) ABAC_COMMAND = ( ''.join(f'aws sqs tag-queue --queue-url <{queue}> --tags team={team}\n' for queue, team in QUEUE_TAGS.items()) - + f'aws iam put-role-policy --role-name {ABAC_ROLE} --policy-name {INLINE_POLICY} ' + + f'aws iam create-role --role-name {ABAC_ROLE} --assume-role-policy-document file://abac-trust.json ' + '# sts:AssumeRole and sts:TagSession\n' + f'aws iam put-role-policy --role-name {ABAC_ROLE} --policy-name {INLINE_POLICY} ' '--policy-document file://same-team.json # aws:ResourceTag/team = ${aws:PrincipalTag/team}\n' f'aws sts assume-role --role-arn {ABAC_ROLE_ARN} --role-session-name orders-dev --tags Key=team,Value=orders\n' f'aws sqs send-message --queue-url <{JOBS_QUEUE}> --message-body hello # same team\n'