How to create a dynamic AWS environment and teardown?

Question

I know it might sound like a basic question but I haven't figured out what to do.

We're working on having a testing environment for screening candidates for Cloud Engineer and BigData interviews.

We are looking into creating on demand AWS environments probably using Cloudformation service and test if the user is able to perform specific tasks in the environment like creating s3 buckets, assigning roles, creating security groups etc using boto3.

But once the screening is finished, we want to automatically tear down the entire setup that has been created earlier.

There could be multiple candidates taking the test at same time. We want to create the environments (which might contain ec2 instances, s3 buckets etc which are not visible to other users) and tear down them once the tests are finished.

We thought of creating IAM users for every candidate dynamically using an IAM role and create a stack automatically and delete those users once the test is finished.

However, I think the users will be able to see the resources created by other users which is not what we are expecting.

Is there any other better approach that we can use for creating these environments or labs and deleting them for users? something like ITversity and Qwiklabs.

The logged in user should have access to and view the resources created only for him.

Please suggest.

Query1: Let's say I have created 10 IAM roles using and one user using each of those roles. Will the user in created from IAM role 1 be able to see the VPCs or EC2 instances or S3 or any other resources created by another user which is created by IAM role 2?

Will the resources be completely isolated from one IAM role to another?

Or does service like AWS Organizations be much helpful in this case?

Answer 1

The Qwiklabs environment works as follows:

• A pool of AWS accounts is maintained
• When a student starts a lab, one of these accounts is allocated to the lab/student
• A CloudFormation template is launched to provision initial resources
• A student login (either via IAM User or Federated Login) is provisioned and is assigned a limited set of permissions
• At the conclusion of the lab, the student login is removed, a "reaper" deletes resources in the account and the CloudFormation stack is deleted

The "reaper" is a series of scripts that recursively go through each service in each region and deletes resources that were created during the lab. A similar capability can be obtained with rebuy-de/aws-nuke: Nuke a whole AWS account and delete all its resources.

You could attempt to create such an environment yourself.