Cloud IAM and Zero Trust Capstone
Table of Contents
Return to the Cloud IAM and Zero Trust Lab Course
The capstone turns an access review into a tested migration plan. Finish and score the submission before opening the reference answer.
Scenario
The payroll reporting environment contains four principals in the synthetic access review . Leadership wants narrower access, short-lived sessions, visible policy decisions, and a rollback path.
Required Deliverables
- Identity map: principal, type, owner, credential, session, role, scope, and revocation
- Effective-access record: one requested action per principal across applicable policy layers
- Review decision: keep, reduce, remove, or investigate with evidence
- Human access target: daily, privileged, and emergency paths
- Workload access target: federation or managed identity, exact trust, short session, narrow role
- Zero trust decision record: subject, runtime, resource, action, context, enforcement, telemetry
- Test matrix: expected allow, expected deny, context failure, and revocation
- Migration order: evidence, owner confirmation, new grant, tests, old grant removal, monitoring
- Rollback plan: trigger, owner, temporary access, expiry, and follow-up
- Lab closure record: choose one route below.
Live Provider Route
Record provider context, objects created, object identifiers, test type, delete results, and absence checks. Keep any unobserved authorization result labeled not run.
Offline Simulator Route
Download the Python simulator and the synthetic fixture . Follow the Lesson 6 offline steps . Attach:
- The full terminal output with
RESULT PASS checks=4/4 simulator-evidence.jsonwith allow, deny, revocation, and cleanup records- The exit code from the simulator
- The successful cleanup result. In Bash or WSL, use
test ! -e sim-state. In PowerShell, useif (Test-Path sim-state) { throw "sim-state still exists" }. - A boundary statement which labels AWS, Azure, Google Cloud, and live tenant closure
not run
A paper preflight and teardown plan earns partial lab-closure credit. Full offline lab-closure credit requires executed simulator evidence.
Constraints
- Do not create a long-lived workload key.
- Do not remove the emergency identity without a tested replacement.
- Do not treat last-used age as sole removal evidence.
- Do not grant policy administration to the report build.
- Do not finish a live lab with temporary objects present.
- Do not label local simulator evidence as live cloud evidence.
Expected Result: required payroll reporting still works, policy administration stays denied, and every old grant has an owner-approved disposition.
Scoring Rubric
| Area | Points | Full-credit evidence |
|---|---|---|
| Identity and access model | 20 | Principals, sessions, trust, roles, scope, revocation |
| Review decisions | 20 | Evidence, owner, business need, escalation path |
| Target design | 20 | Federated human and workload access with narrow roles |
| Zero trust tests | 15 | Allow, deny, context failure, revocation, and evidence labels |
| Migration and rollback | 15 | Safe sequence, owner acceptance, expiry, monitoring |
| Lab closure | 10 | Live route: all created objects removed and absence verified. Offline route: observed simulator allow, deny, revocation, and local cleanup evidence |
Passing score: 80 points. A live lab also requires no leftover lab identity or credential. A plan-only offline closure earns at most 5 of 10 lab-closure points.
Troubleshooting
- Your design keeps Editor: list exact required actions and replace the broad role.
- Your workload uses a stored key: redesign around managed identity or federation.
- Your emergency path disappears: restore a governed recovery identity before enforcement.
- Your live lab leaves a grant: remove the binding or assignment before deleting the identity.
- Your offline evidence lacks one check: rerun the maintained fixture in a fresh folder and attach the complete evidence file.
Verify Completion
- All ten deliverables exist
- Human and workload paths are separate
- The allow and deny test matrix includes expected decisions and evidence labels
- Rollback expires
- Live route: created provider objects are absent
- Offline route: all four simulator checks passed and live closure stays
not run - The submission score reaches 80 out of 100
Review Your Submission
Freeze the submitted package and score it with the rubric. Then open the Cloud IAM and Zero Trust Capstone Answer Key . Record corrections in a separate review log.
