grceng.academy
YAML lab 40 bonus XP

Constrain the invoice exporter

Start labRead the room

Objectives

Halcyon Clinics wants the invoice exporter repaired. The operator proposes a new permanent key and a role named ReadOnly with object.* permissions. Neither the name nor key replacement satisfies the requirement.

Write a declarative control plan, not executable platform policy. Use the fixture's exact identifiers, a role session lasting between 1 and 15 minutes, and an explicit deletion guardrail. Explain how the residual external password is delivered without embedding it. All fields are mandatory.

Approved exporter access contract

principal type: workload
trusted subject: billing-exporter
intended audience: cloud-session
required action: object.read
required resource pattern: invoices/2026/*
explicitly prohibited action: object.delete
static cloud keys permitted: no
session lifetime: at most 15 minutes, positive whole minutes
external password delivery: secret manager (never source files)

Checks the server runs (6)

  • The job uses a workload identity
  • Trust binds the approved subject and audience
  • The allow matches only the required action and prefix
  • Deletion has an explicit guardrail
  • Temporary credentials replace static keys within the lifetime limit
  • The residual password uses managed secret delivery

Check names are all you see here: the expectations that decide pass or fail, and the reference solution, stay on the server.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

  1. Step 1

    Identify the actor

    Classify the caller by whether it is a person or running software; choose the fixture's category rather than the operator's nickname.

    The job uses a workload identity

  2. Step 2

    Bind the exchange

    Find both the named caller and intended recipient in the contract. Restricting just one leaves a different identity-confusion risk.

    Trust binds the approved subject and audience

  3. Step 3

    Bound the operation

    Compare your proposed allow with the business operation and its data partition. Then represent the separately prohibited destructive operation without broadening the grant.

    The allow matches only the required action and prefixDeletion has an explicit guardrail

  4. Step 4

    Bound credential exposure

    Choose credentials that expire rather than persist. Check the stated lifetime units and upper limit, and explicitly disallow the old credential class.

    Temporary credentials replace static keys within the lifetime limit

  5. Step 5

    Handle the remaining password

    Name a controlled retrieval mechanism rather than a source-code location. It must support restricted access and rotation of the destination credential.

    The residual password uses managed secret delivery

Rules summary

  • XP on pass

    40 bonus XP the first time every check goes green.

  • Paid hints

    2 available. Each costs 25% of the lab XP (about 10 XP).

  • Reveal solution

    Scores 0 XP and unlocks only after 3 check runs.

  • Attempt cap

    60 check runs per learner. The runner warns you in the last 10.

  • Drafts

    Your editor content is saved in this browser, so a reload will not lose work.

  • Walkthrough

    Always free and never penalised: use it before spending a hint.