1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Enable MFA on AWS Root Account
Setup Multi-Factor Authentication immediately to protect primary identities.
- Navigate and log in to the AWS Management Console using your root credentials.
- In the top-right corner, click on your account name and select Security Credentials.
- Under the Multi-factor authentication (MFA) section, click Assign MFA device.
- Enter device name
Root-Authenticator, select Authenticator app, and click Next.
- Open your mobile authenticator app (e.g. Google Authenticator), click Show QR Code on AWS, scan it, enter two consecutive MFA tokens, and click Add MFA.
STEP 2
Create a Restricted IAM User & Set Budgets
Provision daily operational user profiles and configure billing alerting ceilings.
- In the AWS Console search bar, type
IAM and select the service.
- Click Users in the left pane, and choose Create user.
- Enter Username:
cloud-sec-student. Choose Attach policies directly, search for and select PowerUserAccess (grants resources management rights while blocking IAM admin manipulations), and click Create.
- Go to the Billing dashboard. Select Budgets -> Create budget -> choose **Zero Spend Budget** -> enter your email -> click **Create**. This logs email alerts if spending exceeds $0.01.
STEP 3
Configure AWS CLI Tooling
Bind API authentication credentials to your local attacker console.
$ aws configure
This interactive command prompts for your AWS Access Key, Secret Key, default region, and format variables.
$ aws iam get-user
This command queries metadata for the currently active API key profile, confirming communication validity.
4. Part 2: Complete Deliverable Assets & Production Templates
To inspect active IAM configuration baselines, we will write a local shell scanner script. Save it as check_iam.sh and execute:
$ chmod +x check_iam.sh && ./check_iam.sh
This updates execution flags and executes the AWS IAM validation check.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
#!/usr/bin/env bash
Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.
# check_iam.sh - AWS Sandbox IAM Auditor Utility
Line 3: This is a comment that describes what the code does: "check_iam.sh - AWS Sandbox IAM Auditor Utility". Comments start with # and are ignored by Python.
set -euo pipefail
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[*] Auditing AWS Sandbox IAM Identity..."
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
CURRENT_USER=$(aws iam get-user --query 'User.UserName' --output text)
Line 6: Creates a variable called CURRENT_USER and assigns a value to it. Variables store data for use later in the program.
echo "[+] Active CLI User profile: ${{CURRENT_USER}}"
Line 7: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# Verify MFA is active on root
Line 8: This is a comment that describes what the code does: "Verify MFA is active on root". Comments start with # and are ignored by Python.
MFA_STATUS=$(aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled' --output text)
Line 9: Creates a variable called MFA_STATUS and assigns a value to it. Variables store data for use later in the program.
if [ "${{MFA_STATUS}}" -eq 1 ]; then
Line 10: A conditional check — the code inside this block only runs if the condition evaluates to True.
echo "[OK] Account Multi-Factor Authentication is Enabled."
Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
else
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "[CRITICAL] MFA is Disabled on Root Account!"
Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
fi
Line 14: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
#!/usr/bin/env bash
# check_iam.sh - AWS Sandbox IAM Auditor Utility
set -euo pipefail
echo "[*] Auditing AWS Sandbox IAM Identity..."
CURRENT_USER=$(aws iam get-user --query 'User.UserName' --output text)
echo "[+] Active CLI User profile: ${{CURRENT_USER}}"
# Verify MFA is active on root
MFA_STATUS=$(aws iam get-account-summary --query 'SummaryMap.AccountMFAEnabled' --output text)
if [ "${{MFA_STATUS}}" -eq 1 ]; then
echo "[OK] Account Multi-Factor Authentication is Enabled."
else
echo "[CRITICAL] MFA is Disabled on Root Account!"
fi
5. Deliverables Summary
Created Files / Templates
- AWS sandbox credentials file:
~/.aws/credentials
check_iam.sh - AWS validation checking script
Verification Artifacts
- CLI logs of
aws iam get-user displaying user profile values.
- Screenshot of the AWS Budgets panel showing the Zero Spend alert.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
