Simply restrict your lab environment of only the essential services that users need.
The IAM Policy Does the following
- Deprovisioning resources becomes a lot much easier when its limited to 1 AWS region
- As the Time is specified in UTC, ideally run the command at the start of class and give it no more than the possible amount of time it takes to run the lab. Otherwise it will only give the Users in that group permissions for that particular time. Basically cuts off access and allows for grading at that point.
- Of course only allow the services that the students need to have access to.
The Json Output of the command above:
Approach
In Powershell, use nested hashtables in addition to the great ConvertTo-Json Feature in Powershell in order to create the IAM Policies
Logic
- List the Services you want to allow and generate the Allow IAM List
- import the list of all iam services and generate the deny IAM List
- Run the Generate-AWSIAMOrgPolicy Command and output it to a .txt file for usage
Caveats
The ConvertTo-Json has a level limitation of 2. Specify it to at least 10 levels and that should more than cover the level of hierarchies in the Json hierarchy
