Prove a guardrail beats an administrator

short · 45 min · Objective 2.3

Task

Apply an organisation-level policy, then attempt the denied action as an identity with unrestricted permissions inside the account -- which is the whole point of the mechanism.

Steps

  1. Apply a policy above the account denying at least three things: resource creation outside one region, disabling the configuration recorder, and deleting the log destination.
  2. As an identity with full administrative permissions INSIDE the account, attempt each of the three and capture the refusals in lab/guardrail-deny.txt.
  3. Note that guardrails apply to future actions, not existing state: find any resource already violating one and record it in lab/guardrail-sweep.csv as resource,violation,remediated.
  4. Remediate the existing violations, since the guardrail will not.
  5. Create one deliberate exception -- a carved-out role or account -- and record in lab/guardrail-exception.md why an exception mechanism is necessary rather than optional.

Verify

grep -Eic 'denied|explicit deny|not authorized|scp' lab/guardrail-deny.txt
grep -c . lab/guardrail-deny.txt
awk -F, 'NR>1 {n++} END {print n" pre-existing violation(s)"}' lab/guardrail-sweep.csv
grep -Eci 'disabled wholesale|bypass|exception' lab/guardrail-exception.md

Three refusals against an administrative identity, the pre-existing sweep run, and the exception rationale written. A guardrail deployed without the sweep leaves the violations it was created to stop already in place.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.