AWS IAM: users, groups and policies

Baobab Market sells the work of forty Senegalese craftspeople online. The company has just moved to AWS, and the whole team signs in with the same account, the founder's, whose password circulates in the WhatsApp group. That account can do anything, including shutting the company down on AWS with one click. She asks you to put things in order: one identity per person, each with only what they need. This lab opens the preparation path for the AWS Certified Cloud Practitioner certification. It covers cloud concepts and above all security, the heaviest domain of the exam. You start with the map of AWS: Regions, Availability Zones, and why IAM is a global service. Then you find out who you are in the account, and what AWS protects versus what remains yours in the shared responsibility model. You learn to read an IAM policy and predict AWS's decision: explicit deny, allow, implicit deny. You organize the team into groups by job, create users capped by a permissions boundary, and trigger denials on purpose to learn to read an AccessDenied message. You then write your own policy, following the principle of least privilege, and prove in the policy simulator that everyone has what they need and nothing more. Everything happens in the real AWS console, opened in your browser, with no credit card and no account to create. The guide is illustrated with screenshots of the console, and the lab ends with a ten-question practice exam in the style of the certification.