Cloud identity and access management in Cybersecurity - Mini Project: Build & Apply

Cloud Identity and Access Management Basics

📖 Scenario: You are working in a company that uses cloud services. To keep the cloud resources safe, you need to manage who can access what. This is called Cloud Identity and Access Management (IAM). You will create a simple list of users and their roles, then set rules to control access.

🎯 Goal: Build a basic cloud IAM setup by creating a list of users with roles, defining access levels, assigning permissions based on roles, and finalizing the access control list.

📋 What You'll Learn

Create a dictionary named users with exact user names and roles

Create a dictionary named access_levels with role names and their access rights

Create a new dictionary named permissions that maps each user to their access rights using dictionary comprehension

Add a final key policy_version with value "2024-01-01" to the permissions dictionary

💡 Why This Matters

🌍 Real World

Cloud IAM is used by companies to control who can access cloud resources like servers, databases, and applications securely.

💼 Career

Understanding IAM basics is essential for cybersecurity roles, cloud administrators, and IT professionals managing cloud environments.

1

Create the user roles dictionary

Create a dictionary called users with these exact entries: 'alice': 'admin', 'bob': 'editor', 'carol': 'viewer', 'dave': 'editor'.

Cybersecurity

# Create the users dictionary with names and roles
# Your code here

Hint

Use curly braces to create a dictionary. Each key is a user name string, and each value is their role string.

2

Define access levels for roles

Create a dictionary called access_levels with these exact entries: 'admin': 'full_access', 'editor': 'edit_access', 'viewer': 'read_only'.

Cybersecurity

users = {'alice': 'admin', 'bob': 'editor', 'carol': 'viewer', 'dave': 'editor'}
# Create the access_levels dictionary with roles and their access rights
# Your code here

Hint

Map each role to its access right using a dictionary.

3

Assign permissions to users

Create a dictionary called permissions using dictionary comprehension that maps each user in users to their access right from access_levels based on their role.

Cybersecurity

users = {'alice': 'admin', 'bob': 'editor', 'carol': 'viewer', 'dave': 'editor'}
access_levels = {'admin': 'full_access', 'editor': 'edit_access', 'viewer': 'read_only'}
# Create permissions dictionary mapping users to access rights
# Your code here

Hint

Use dictionary comprehension with for user, role in users.items() to assign access rights.

4

Add policy version to permissions

Add a new key 'policy_version' with value "2024-01-01" to the permissions dictionary.

Cybersecurity

users = {'alice': 'admin', 'bob': 'editor', 'carol': 'viewer', 'dave': 'editor'}
access_levels = {'admin': 'full_access', 'editor': 'edit_access', 'viewer': 'read_only'}
permissions = {user: access_levels[role] for user, role in users.items()}
# Add the policy_version key to permissions
# Your code here

Hint

Use the dictionary key assignment syntax to add the new key and value.

Practice

1. What is the main purpose of Cloud Identity and Access Management (IAM)?

easy

A. To control who can access cloud resources and what actions they can perform

B. To store data securely in the cloud

C. To monitor network traffic in cloud environments

D. To manage cloud billing and payments

Solution

1. Step 1: Understand the role of IAM

   IAM is designed to manage access permissions for users and services in the cloud.

2. Step 2: Compare options with IAM purpose

   Only To control who can access cloud resources and what actions they can perform describes controlling access and actions, which is the core of IAM.

3. Final Answer:

   To control who can access cloud resources and what actions they can perform -> Option A

4. Quick Check:

   IAM controls access and permissions [OK]

Hint: IAM manages access and permissions, not data or billing [OK]

Common Mistakes:

• Confusing IAM with data storage services
• Thinking IAM handles billing or payments
• Mixing IAM with network monitoring tools

2. Which of the following is the correct way to assign a role to a user in a cloud IAM policy?

easy

A. Delete the user and recreate with the role

B. Assign the role directly to the user in the IAM policy

C. Create a new user without any roles

D. Assign the role to the cloud storage bucket

Solution

1. Step 1: Understand role assignment in IAM

   Roles are assigned to users or groups to grant permissions.

2. Step 2: Evaluate options for correct syntax

   Assigning the role directly to the user is the correct method; other options are incorrect or unrelated.

3. Final Answer:

   Assign the role directly to the user in the IAM policy -> Option B

4. Quick Check:

   Roles assigned directly to users [OK]

Hint: Roles go to users or groups, not resources like buckets [OK]

Common Mistakes:

• Assigning roles to resources instead of users
• Creating users without roles expecting access
• Deleting users unnecessarily to assign roles

3. Consider this IAM policy snippet:

{"bindings": [{"role": "roles/viewer", "members": ["user:[e-mail]"]}]}

What permission does Alice have?

medium

A. Write access to modify resources

B. Full admin access to all resources

C. No access to any resources

D. Read-only access to view resources

Solution

1. Step 1: Identify the role in the policy

   The role assigned is "roles/viewer", which is a predefined role for read-only access.

2. Step 2: Understand what "roles/viewer" means

   This role allows viewing resources but not modifying or administering them.

3. Final Answer:

   Read-only access to view resources -> Option D

4. Quick Check:

   roles/viewer = read-only access [OK]

Hint: "viewer" role means read-only access [OK]

Common Mistakes:

• Confusing viewer with admin or editor roles
• Assuming viewer can modify resources
• Ignoring the role name and guessing permissions

4. A cloud IAM policy is not working as expected. The user cannot access resources despite being assigned a role. What is a common mistake to check?

medium

A. The cloud region is incorrect

B. The cloud storage bucket is empty

C. The user email is misspelled in the policy

D. The user has too many roles assigned

Solution

1. Step 1: Identify common IAM policy errors

   One frequent error is a typo in the user identifier, such as a misspelled email.

2. Step 2: Understand impact of misspelled user

   If the user email is wrong, the policy does not apply to the intended user, causing access failure.

3. Final Answer:

   The user email is misspelled in the policy -> Option C

4. Quick Check:

   Misspelled user email blocks access [OK]

Hint: Check user email spelling first when access fails [OK]

Common Mistakes:

• Ignoring typos in user or group names
• Blaming resource content instead of permissions
• Assuming too many roles cause denial

5. You want to give temporary access to a contractor for only one cloud project without exposing other projects. Which IAM feature should you use?

hard

A. Assign a role with project-level scope and set an expiration time

B. Add the contractor to the organization-wide admin group

C. Create a new user with full access to all projects

D. Share your personal login credentials with the contractor

Solution

1. Step 1: Identify requirement for limited, temporary access

   The contractor needs access only to one project and only temporarily.

2. Step 2: Choose IAM feature matching scope and duration

   Assigning a role scoped to the project with an expiration time fits the need perfectly.

3. Step 3: Evaluate other options

   Other options give too broad access or are insecure practices.

4. Final Answer:

   Assign a role with project-level scope and set an expiration time -> Option A

5. Quick Check:

   Project-scoped role + expiration = temporary limited access [OK]

Hint: Use scoped roles with expiration for temporary access [OK]

Common Mistakes:

• Giving organization-wide admin rights unnecessarily
• Sharing personal credentials (security risk)
• Creating users with full access instead of limited