Sandbox · role: duck-test-role

Build a permission set. Watch the shield sweat.

A fake IAM role with a fake policy document. Toggle statements on and off and watch the blast-radius score react. Nothing here touches a real cloud.

Read S3 objects

s3:GetObject

Reasonable. Ducks approve.

Write S3 objects

s3:PutObject

Fine, if scoped to one bucket.

Full S3 access

s3:*

Every bucket. Every object. Bold.

Pass any IAM role

iam:PassRole

The classic privilege-escalation special.

Full EC2 access

ec2:*

Enough to spin up a small fleet.

Everything, everywhere

*:*

The one permission this duck fears.

Blast radius

MINIMAL

No permissions granted. This role can do approximately nothing, which is the dream.