Identity first, state second
Cloud and AWS
In the cloud you never hold the machine — you hold a policy and a record of what should exist. Every failure is either 'who am I' (credentials) or 'what exists' (state), and the CLI answers both.
Who am I, before what can I do
Every call is authorised against an identity. The CLI reads a profile, the profile names an access key, and IAM decides. That is why the first debugging command is always `sts get-caller-identity`, not the command that failed.
Least privilege is the default posture: grant the actions the workload needs, on the resources it needs, and nothing else. It is also the only version of the policy you can reason about later.
Resources are records
Creating a bucket or an instance writes state you can read back as JSON. Grade your work on that state, never on the command's exit code — a silent no-op returns zero.
Buckets deserve the four public-access settings by default: block public ACLs, ignore public ACLs, block public policy, restrict public buckets. Versioning and encryption are cheap; the incident is not.
Commands in this lesson
Every one of these runs in the sandbox — no real account, no real bill.
| Command | Why |
|---|---|
aws s3api create-bucket --bucket ophir-assets --create-bucket-configuration LocationConstraint=eu-west-1 | Region matters at creation time; you cannot move a bucket later. |
aws s3api put-bucket-versioning --bucket ophir-assets --versioning-configuration Status=Enabled | Turns an overwrite into a recoverable event. |
aws s3api put-public-access-block --bucket ophir-assets --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true | Four settings, one statement: nobody outside can make this public by accident. |
aws ec2 run-instances --image-id ami-0abcd1234 --instance-type t3.micro --security-groups web-sg | Image + size + firewall is the whole definition of a VM. |
aws ec2 describe-instances > /opt/instances.json | Read the account back; do not trust that a create returned something. |
Now do it
Reading the model makes the first attempt faster. Only the lab makes you able to do it.
- Open the lab
AWS Account Setup and IAM Configuration
Beginner · 25 min · members
- Open the lab
Create a Secure, Private S3 Bucket
Intermediate · 25 min · members
- Open the lab
Launch an EC2 Instance Behind a Least-Privilege Security Group
Intermediate · 30 min · members
- Open the lab
AWS: Least-Privilege IAM User and Group
Intermediate · 25 min · members
Cloud and AWS · OphirCloud Academy · all lessons