The backlog for course 2, the IAM repo. Fifteen lessons and an appendix, one issue each, labelled by lesson id. Each issue names what has to exist in the reference repo, the checks and the desk for the lesson to be teachable, its done-when from prescriptions.md, and the kit-era issues it replaced.
The course manages this repo's own AWS access as Terraform, one resource per file, with the PR as the only write path and an agent working the repo as concierge and watcher. The estate, its principals and its six canonical scenarios are in content/docs/estate.md. The phases that order the work are in project/plan.md.
| Lesson |
Issue |
| I1 One resource per file |
#39 |
| I2 Personas and principals |
#40 |
| I3 Guardrails in the editor |
#41 |
| I4 Deploy to Floci |
#42 |
| I5 The permission boundary |
#43 |
| I6 One path to prod |
#44 |
| I7 Drift |
#45 |
| I8 Delegation and the double refusal |
#46 |
| I9 Federation trust |
#47 |
| I10 Break-glass |
#48 |
| I11 Offboard and access review |
#49 |
| I12 The concierge |
#50 |
| I13 The watcher |
#51 |
| I14 Approve the change, not the diff |
#52 |
| I15 Adopt in place |
#53 |
| IA The appendix |
#54 |
Before any of these, plan phase 0 verifies the ground: that Floci carries enough IAM and S3 for terraform plan -detailed-exitcode, import blocks and the iam:PermissionsBoundary condition. #42 (I4) is gated on it and most others assume it.
History. This epic was filed on 2026-07-28 as "cross-cloud IAM/security kit on chant", with tracks A to E. Decision 26 made water park a courses repo, decisions 31 and 32 moved course 2 to Terraform and made the repo's own access the estate. The kit-era issues #2 to #33 were closed on 2026-09-05, each pointing at the lesson issue that replaced it, and the archive mapping is in project/archive/issues.md. Cross-cloud (Track B) stays parked on persona equivalence (decision 19).
The backlog for course 2, the IAM repo. Fifteen lessons and an appendix, one issue each, labelled by lesson id. Each issue names what has to exist in the reference repo, the checks and the desk for the lesson to be teachable, its done-when from prescriptions.md, and the kit-era issues it replaced.
The course manages this repo's own AWS access as Terraform, one resource per file, with the PR as the only write path and an agent working the repo as concierge and watcher. The estate, its principals and its six canonical scenarios are in content/docs/estate.md. The phases that order the work are in project/plan.md.
Before any of these, plan phase 0 verifies the ground: that Floci carries enough IAM and S3 for
terraform plan -detailed-exitcode,importblocks and theiam:PermissionsBoundarycondition. #42 (I4) is gated on it and most others assume it.History. This epic was filed on 2026-07-28 as "cross-cloud IAM/security kit on chant", with tracks A to E. Decision 26 made water park a courses repo, decisions 31 and 32 moved course 2 to Terraform and made the repo's own access the estate. The kit-era issues #2 to #33 were closed on 2026-09-05, each pointing at the lesson issue that replaced it, and the archive mapping is in project/archive/issues.md. Cross-cloud (Track B) stays parked on persona equivalence (decision 19).