IAM Least Privilege with Permission Boundaries

Permission boundaries are the AWS-recommended guardrail for letting platform teams safely delegate IAM to application teams. In this lab you'll act as the platform engineer: you'll author a boundary policy, apply it to a developer role, verify the role can do its day job (EC2, S3, Lambda), and then try to escalate privileges from inside the role to confirm the boundary holds.

You will:

• Author a permission boundary policy that allows EC2, S3, and Lambda but denies billing, IAM admin, and Organizations
• Create a developer role with a broad permissions policy AND the boundary attached
• Assume the developer role and verify allowed day-job actions succeed
• Attempt classic privilege escalation paths (create admin role, attach AdministratorAccess to self) and confirm the boundary blocks them

This lab uses STS AssumeRole with a local AWS CLI profile so you can switch identities without leaving the workstation.