# Exercise 1: Build a Least-Privilege IAM Role by Hand

```
STEP 1. Write a trust policy that lets ONLY the EC2 service assume this role.
STEP 2. Write a permission policy that grants read-only access to a single
        named S3 bucket ("reports-bucket-prod") and nothing else.
STEP 3. Write a Deny statement that blocks deleting objects even if some
        other (hypothetical) future policy tries to allow it.
STEP 4. Create the role and attach both documents with the AWS CLI commands
        given below (fill in the blanks marked TODO).
STEP 5. Verify with `aws iam simulate-principal-policy` that the role CAN
        read objects and CANNOT delete them.
```

This is a config-only exercise (JSON + CLI) — no interpreter to run, so verify yourself against the **Requirements Checklist** at the bottom instead of a PASS/FAIL script.

## Trust Policy (TODO)

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "TODO-fill-in-the-service-principal" },
      "Action": "TODO-fill-in-the-action-that-lets-something-assume-a-role"
    }
  ]
}
```

## Permission Policy (TODO)

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowReadOnly",
      "Effect": "TODO",
      "Action": ["TODO", "TODO"],
      "Resource": [
        "TODO-bucket-arn",
        "TODO-bucket-arn-with-object-wildcard"
      ]
    },
    {
      "Sid": "ExplicitlyBlockDelete",
      "Effect": "TODO",
      "Action": "TODO-the-delete-object-action",
      "Resource": "TODO"
    }
  ]
}
```

## CLI Commands (TODO)

```bash
# 1. Create the role with the trust policy above (save it as trust-policy.json first)
aws iam create-role --role-name ReportsReadOnlyRole --assume-role-policy-document file://TODO.json

# 2. Attach the permission policy (save it as permission-policy.json first)
aws iam put-role-policy --role-name TODO --policy-name TODO --policy-document file://TODO.json

# 3. Confirm what the role can actually do
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/ReportsReadOnlyRole \
  --action-names s3:GetObject s3:DeleteObject \
  --resource-arns arn:aws:s3:::reports-bucket-prod/file.csv
```

## Requirements Checklist

- [ ] Trust policy's `Principal` is scoped to `ec2.amazonaws.com` only — not `"*"`, not another service.
- [ ] Permission policy grants `s3:GetObject` and `s3:ListBucket` (or equivalent read actions) ONLY on `reports-bucket-prod` and its objects — no `Resource: "*"`.
- [ ] Permission policy contains a separate statement with `Effect: Deny` on `s3:DeleteObject` for the same bucket.
- [ ] Explain in one sentence (write it as a comment above the Deny statement) why this Deny statement is redundant-but-safe: because there is no Allow for delete anywhere in this policy already, so the implicit deny would also block it — the explicit Deny exists as a hedge against a *future* policy attachment ever accidentally granting delete.
- [ ] `simulate-principal-policy` for `s3:GetObject` returns `allowed`.
- [ ] `simulate-principal-policy` for `s3:DeleteObject` returns `explicitDeny` (not just "implicitDeny") — confirming your Deny statement is the one doing the blocking.