AWS IAM and logging baseline

Goal: practice the security baseline that should exist before any AI workflow receives access to cloud resources.

Outcome

You should finish with a written access model, a logging checklist, and a small AWS lab account pattern that proves you understand identity, auditability, and cost control.

Build pattern

  1. Create a dedicated learning account or isolated sandbox environment.
  2. Enable MFA on the root user and avoid using root for routine work.
  3. Create a limited admin role for your own lab work.
  4. Create one read-only role and one narrowly scoped builder role.
  5. Enable CloudTrail for account activity and send logs to a dedicated S3 bucket.
  6. Create a CloudWatch log group for application/lab notes.
  7. Create a budget alert before deploying anything AI-related.

What to document

  • Which principal can read resources?
  • Which principal can write or change resources?
  • Which actions are intentionally denied?
  • Where would you look if something changed unexpectedly?
  • What budget or cleanup rule prevents a surprise bill?

Portfolio artifact

Create a one-page README called aws-ai-security-baseline.md. Include your role model, logging flow, cost guardrail, and one paragraph explaining why AI tools should not receive broad cloud permissions by default.

Safety boundary

Use test resources only. Do not connect this to employer, client, production, regulated, or confidential data.