Course 2 · after Fountain

The IAM repo

Watch

TODO: video — course intro

course intro

Context

The estate is water park’s own AWS (the estate ). The repo you cloned to take this course is the repo the course puts under management, which is the point. The pattern is one resource per file, the PR as the write path and blame as the audit trail. The house rules and the decisions ledger are the why.
The repo is Terraform with one resource per file, and Terraform is the applier (decision 31). The checks are terraform validate and tflint, the proofs are Access Analyzer. The agent app is the AWS desk . water park is a pattern rather than a tool, so the pairing of Fountain with Terraform is a course choice, and the design docs describe what changes on a typed backend instead.
Each lesson names the properties it demonstrates and the prescription it closes. Self-paced runs on Floci. Live runs on real sandbox accounts with the live session guide .

Intro

TODO: course intro, under 250 words

15 lessons · about 9 h 25 min self-paced

1 One resource per file The repo is Terraform with one resource per file. · 40 min I P1P2 I1
2 Personas and principals Humans get permission sets and workloads get roles. · 45 min V P2P3 I2
3 Guardrails in the editor The guardrails run in the editor, for the agent and in the PR job alike. · 45 min II P4 I3
4 Deploy to Floci The estate deploys to Floci with no account. · 30 min XII P6 (part) I4
5 The permission boundary The permission boundary caps every role and the apply role itself. · 45 min VIIII P7 I5
6 One path to prod The PR is the only path to the estate. · 75 min IVIXXIVII P5P6P7 I6
7 Drift A scheduled plan detects drift and a PR restores the declared state. · 35 min XIXIII P11 I7
8 Delegation and the double refusal A satellite may create roles only inside the boundary, checked twice. · 50 min VI P8P10 I8
9 Federation trust Trust policies are declared resources with the strictest checks. · 30 min XV P12 I9
10 Break-glass Break-glass access expires cloud-side whatever else fails. · 30 min VIIVIII P9 I10
11 Offboard and the access review Offboarding removes every reference in one PR and the review reads the estate. · 25 min IXXIII I11
12 The concierge The AWS desk turns a request into a one-file PR. · 45 min VVIIIIX P13 I12
13 The watcher The desk on a schedule turns findings into capped PRs. · 30 min XIII I13
14 Approve the change, not the diff The reviewer approves the rendered plan, bound by a digest. · 20 min VIIIXIVVII P14 I14
15 Adopt in place Existing resources come under management by import with nothing touched. · 20 min IXII I15