Ravi Sir's Cards › AWS
AssumeRole and prove access
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
Why do we need it?
Without a prove step, you do not know if the session is the role or still your admin user.
What is it?
Export the three STS values, call get-caller-identity, list the lab bucket (allow), then try a bucket outside the policy (deny).
How to do it
eval or export the credentials JSON fields, then aws s3 ls on the lab bucket and on an unrelated bucket.
get-caller-identity
Example
Caller identity ARN contains assumed-role; lab bucket lists; other bucket is AccessDenied.