IAM
IAM Essentials
Create roles and policies, and see least privilege at work.
BETAFree during the beta
Learn AWS by building in a real account
Hands-on labs for students, freshers and working engineers. Each session gives you a short lesson, a real task and a real AWS account we provision, check and clean up.
- ✓No credit card
- ✓No setup
- ✓No AWS account of your own
shalabs · s3-static-website58:12 left
18%
2
DONE
0/6
TASKS
0/5
QUIZ
- ✓
Where do your users' files go?
Lesson
- ✓
Buckets, objects and keys
Lesson
Create the uploads bucket
Task
Turn on versioning
Task
Upload a file
Task
Open your file
Task
Open the old version
Task
TASK · VERIFIED BY CHECKS
Create the uploads bucket
Before the app can store a single file, it needs a private bucket.
Requirements
- A bucket named
examapp-uploads-••••4821inus-east-1 - Block all public access left turned on
Step 3 of 11PreviousSubmit
YOUR AWS ACCOUNTLIVE
- ACCOUNT
- •••• 4821
- REGION
- us-east-1
- ACCESS
- this lab only
CHECKSNOT SUBMITTED
Your bucket exists
Block Public Access is fully on
How it works
- 1
Start a lab
Sign in and pick a lab. An AWS account is claimed for you and locked to your session.
- 2
Learn the idea
Short lessons explain the concept and why it matters, one idea at a time.
- 3
Build it in AWS
Do the task in the real AWS console, or in a browser terminal for Terraform.
- 4
Get it checked
Automatic checks read your account, read-only, and tell you what is still missing.
Labs open today
Every lab is one 60-minute session. We open a new lab only after its permissions and worst-case cost have been reviewed.
S3
Store your app's user uploads
Move uploads to a private bucket, with versioning and presigned links.
EC2
Your first EC2 instance
Launch a small server, connect to it, and learn what still bills after you shut it down.
TERRAFORM
Your first EC2 instance with Terraform
Plan, apply and destroy real infrastructure from a browser terminal and code editor.
A real account, with safe limits
One account, one learner
Each session runs in its own AWS account. No other learner is in it.
Access limited to the lab
Permissions cover what the lab teaches, in one region. AWS refuses the rest.
No keys to leak
Console access uses short-lived credentials that end with your session.
No AWS bill for you
ShaLabs owns the account and pays for it. You never enter a card for AWS.
Cleaned before reuse
Everything you create is deleted, and an account returns to the pool only after it is checked empty.
Recorded and watched
Activity in the account is recorded, and limits stop costly settings and misuse.
Built on AWS
ShaLabs runs on AWS and teaches AWS. Every lab session uses a real AWS account, so learners practise on the same services they will use at work.
- AWS Organizations
- A dedicated pool of sandbox accounts, fenced by service and resource control policies.
- IAM and STS
- Temporary, scoped access for each session, with no stored access keys.
- CloudFormation StackSets
- The same security baseline in every sandbox account.
- Resource Explorer
- Finds what a session created, so cleanup can remove it and validation can prove it is gone.
- CloudTrail and EventBridge
- An organization-wide record of activity, and the events that drive the guardrails.
- EC2 and Systems Manager
- The backend runs on EC2, reached through Session Manager, with its settings in Parameter Store.
Questions, answered
Do I need my own AWS account?
No. Each session gets a real AWS account we provision for you. There is nothing to sign up for with AWS and no card to enter.
Could I end up with a bill?
No. ShaLabs owns the account and pays its AWS bill, and everything you create is deleted when your session ends.
Is ShaLabs free?
Labs are free during the beta. After the beta, ShaLabs will be a paid product, and we will publish the pricing before any charge begins.
What happens when the hour is up?
The session ends and the account is wiped and checked empty. Your progress stays on your profile.
What if I break something?
That is fine. Your access is limited to the lab, and the account is cleaned out afterwards.
How are tasks checked?
When you submit, the checks read your AWS account, read-only, and tell you what isn’t there yet. The few you confirm yourself are marked as self-checks.
Do I need to install anything?
No. The lessons, the AWS console and the Terraform lab's terminal and editor all open in your browser.
Start your first lab
Free during the beta. No credit card and nothing to install.