Hands-on emulator lab · 6–10 min
Give just enough permission — IAM and S3
Give a practice role one narrow permission and inspect its policy.
These actions use an isolated AWS Emulator. It stores API state locally; it does not create paid cloud resources or run the full hosted AWS service.
Your goal
Give a practice role one narrow permission and inspect its policy.
Why this matters
An application should get only the actions and resources it needs. You will attach a narrow read policy to a practice role and inspect it. A stored policy is different from a full authorization test.
Words you will use
IAM manages access. A role is an identity an app can use. A policy is a set of permission rules. An ARN is the full AWS name of a resource.
How to proceed
Start a fresh emulator, read each numbered step, and enter the practice settings shown. Run the action, inspect its API receipt, then continue. Finish lab checks the emulator state again before saving your progress.
1. Create a practice role
Create a role trusted by Lambda. A trust policy says who may take on the role; its permission policy says what that role may do. The next step adds the second part.
2. Allow one read action
Save a policy allowing s3:GetObject only on objects in practice-files. Read the action and resource in the request. This lab stores a narrow policy; it does not prove every real AWS authorization decision.
3. Inspect the saved permission
Read the inline policy from your role. Check the action and resource. A policy attached to the wrong role would not satisfy this lab.
Practice, then check your understanding
Perform the actions yourself and inspect the returned state. Errors keep your settings so you can retry. Starting another lab clears the previous live environment. Earned XP is kept, and signed-in achievements sync to your account. Replay does not award duplicate XP.
Read the official AWS documentation for service behavior and production details.