Unit 1: How a cloud account is laid out · Lesson 1 of 5 · 16 min
Your first five minutes in an account
Confirm which account, identity and region your commands will hit before you touch anything.
mission
- You are
- You just joined the security team at Brightwell, a company that teaches languages online and runs an AI tutor.
- Situation
- Your manager has asked for a cloud security review. Your laptop is set up with the AWS CLI and a key for a user called
secops. - Goal
- Prove which account, identity and region every command you run will use.
- Hand in
- The account ID, your user name and the region, written in ~/audit/notes.txt.
Who secures what
Read the lab notes
Every engagement starts with the scope. Read what the machine contains and what it talks to.
cat README.txt
Brightwell cloud lab
This machine talks to a simulated AWS account (123456789012, eu-west-1).
Your identity is the secops user. aws, jq, git and python3 with boto3 are installed.
The simulator does not enforce permissions: you can change things, so check before you fix.
repos/brightwell-website the website repository
audit/ your notes and scripts
you should see An account ID, a region and the warning that this simulator lets you change things.
Ask AWS who you are
sts get-caller-identity needs no permissions and answers the most important question in the cloud: whose key is this?
aws sts get-caller-identity
{
"UserId": "5280t6oujvcpghvddoct",
"Account": "123456789012",
"Arn": "arn:aws:iam::123456789012:user/secops"
}
you should see Account and an Arn ending in user/secops.
defender tip Run this before every change. Engineers with several accounts configured fix the wrong one more often than you would think.
See where the credentials come from
The CLI looks in environment variables, then in ~/.aws. Knowing which one won tells you which key to rotate if it leaks.
aws configure list
Name Value Type Location
---- ----- ---- --------
profile <not set> None None
access_key ****************EVBU shared-credentials-file
secret_key ****************pWGr shared-credentials-file
region eu-west-1 env AWS_DEFAULT_REGION
you should see The key comes from the shared credentials file and the region from an environment variable.
Check which team you belong to
Permissions usually come through groups. Your group tells you what you are allowed to look at and fix.
aws iam list-groups-for-user --user-name secops --query 'Groups[].GroupName' --output text
security-team
Write it down
Auditors record the starting point so every later finding can be tied to an account and an identity.
aws sts get-caller-identity --query '[Account,Arn]' --output text >> audit/notes.txt cat audit/notes.txt 123456789012 arn:aws:iam::123456789012:user/secops
Who owns the fix
Data centre doors and guards Hypervisor patches S3 service availability Physical disk disposal
You verify these through their compliance reports.
Who has an access key Which buckets are public Which ports are open What data the AI tutor can read
Every lesson in this course lives on this side.
What a defender takes away
- 1The provider secures the cloud. You secure what you put in it and how you configure it.
- 2
aws sts get-caller-identitytells you whose key you are using, with no permissions needed. - 3Credentials come from environment variables first, then ~/.aws. Know which one is active.
- 4Record the account, identity and region before your first finding.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.