🛠️ Lab 10 — Free-Tier Account, Least-Privilege IAM User, and a Zero-Cost Budget Guardrail (50 pts)

Goal: Stand up a free-tier AWS account (or confirm your existing one), practice least-privilege IAM by creating a scoped, non-root IAM user with a custom read-only policy on a single S3 bucket, prove the scoping works with the IAM Policy Simulator, and set up a \$1 AWS Budget with layered email alerts so you never get an unpleasant billing surprise. Every step uses only free-tier or no-cost AWS features — no paid resources required.

Steps

  1. Create your account and lock down root. If you don't already have one, sign up for an AWS account (aws.amazon.com/free) — no purchase required. Sign in as root exactly once to enable MFA on the root user. Do not create or use root access keys at any point in this lab.
  2. Create a scoped IAM user. In the IAM console, create a new IAM user named s3-readonly-lab with console access. Do not attach any AWS-managed "Full Access" policies.
  3. Create an S3 bucket to scope against. Create a new, empty S3 bucket (default settings, block all public access) — the one resource your new user is allowed to read.
  4. Write a scoped custom JSON policy following AWS's official IAM least-privilege guidance, granting only s3:GetObject and s3:ListBucket on your one bucket's ARN (not "Resource": "*"). Attach it directly to s3-readonly-lab.
  5. Verify access is denied everywhere else using the IAM Policy Simulator. Test: (a) s3:GetObject on your bucket — Allowed; (b) s3:PutObject on your bucket — Denied; (c) s3:GetObject on any other bucket ARN — Denied; (d) ec2:RunInstances — Denied. Screenshot each result.
  6. Set up a zero-cost AWS Budget. In Billing and Cost Management → Budgets, create a monthly cost budget of \$1.00. Add three alert thresholds: 50% actual, 85% actual, and 100% forecasted, each emailing your own address.
  7. Enable Free Tier usage alerts in Billing Preferences and confirm your alert email address.
  8. Write a short reflection (150–250 words) covering: which AWS free-tier layer (signup credit, always-free, or trial) your account falls under and why that matters; what would happen to your resources at 100% of budget with only alerts configured (no Budget Actions); and one specific proactive guardrail (IAM policy restriction, service quota, or Budget Action) you'd add to actually enforce the limit.

Deliverables: Submit a PDF or document containing: (1) your custom JSON IAM policy, (2) four Policy Simulator screenshots from Step 5, (3) a screenshot of your configured Budget with its three thresholds, (4) a screenshot confirming Free Tier usage alerts are enabled, and (5) your written reflection.