IBM Cloud Security Lab: IAM, Key Protect and COS
This is a hands-on IBM Cloud security lab. You take over a fictional account that grew on one shared setup and make 12 scored decisions on access groups, trusted profiles, MFA, API keys, VPC security groups, key management and Cloud Object Storage.
Feedback names the real features and cites IBM documentation. Read the secure IBM Cloud architecture guide for the design behind the answers, or score your own account with the IBM Cloud Security Checklist.
You are Marcus Webb, the new cloud security engineer at Northgate Logistics, a fictional company that runs on IBM Cloud with one shared account and a lot of goodwill. Across 12 decisions you fix it: resource groups, access groups, MFA, federation and trusted profiles, API keys, access reviews, VPC security groups, Key Protect and Hyper Protect Crypto Services, Cloud Object Storage public access, Activity Tracker and the Security and Compliance Center. Each call is scored 0 to 10 and the feedback cites the IBM documentation behind it. All names are invented.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this is
5 points
- A scenario lab where you secure a fictional IBM Cloud account that grew on one shared setup.
- You make 12 scored decisions on: resource groups, access groups and administrators, MFA, trusted profiles for federated users and for workloads, API key hygiene, access reviews, VPC security groups, Key Protect versus Hyper Protect Crypto Services, Cloud Object Storage public access, Activity Tracker routing and the Security and Compliance Center.
- Each decision scores 0 to 10. Feedback names the real IBM Cloud feature and cites the IBM documentation. Our own reasoning is labelled PlayCISO practice.
- Free to play. All names are invented. The lab teaches what to set and why; it contains no attack steps.
- Pair it with the IBM Cloud Security Checklist to score your own account.
Frequently asked questions
What does the IBM Cloud Security Lab teach?
It teaches how to build access control and guardrails in an IBM Cloud account: resource groups per environment, access groups instead of per-user policies, account-level MFA, trusted profiles for federated users and compute workloads, API key limits, regular access reviews, VPC security groups, key management with Key Protect or Hyper Protect Crypto Services, private Cloud Object Storage buckets and routed audit events.
Why use trusted profiles instead of service ID API keys?
IBM documents trusted profiles as a way to grant access without managing credentials: for compute workloads you are not required to create service IDs or API keys, and IBM calls trusted profiles a best practice for applications running on IBM Cloud compute resources. The lab scores a trusted profile with conditions above a stored key.
What is the difference between Key Protect and Hyper Protect Crypto Services?
IBM describes Key Protect as a multi-tenant key management service, and Hyper Protect Crypto Services as single-tenant on dedicated, customer-controlled HSMs, with a Keep Your Own Key capability. They share a key-provider API. Both support dual authorization for deletion and rotation schedules.
Can I make a Cloud Object Storage bucket public?
IBM says the Public Access group must be enabled at the account level before you can enable public access on a bucket, and that bucket-level public access exposes every object in the bucket to anyone with the URL. The lab scores removing the policy and using expiring pre-signed URLs above leaving it public.
Is this the CIS IBM Cloud benchmark?
No. It is a decision lab based on IBM Cloud documentation. For a self-assessment across domains use the IBM Cloud Security Checklist, and for the authoritative control list use the CIS IBM Cloud Foundations Benchmark itself.
Sources
All read on 4 November 2026. Lines in the feedback marked “PlayCISO practice” are our own reasoning, not an IBM statement.
- IBM Cloud documentation: Best practices for organizing resources and assigning access
- IBM Cloud documentation: Managing resource groups
- IBM Cloud documentation: Setting up access groups
- IBM Cloud documentation: Trusted profiles for federated users and workloads
- IBM Cloud documentation: Enabling multifactor authentication (MFA)
- IBM Cloud documentation: Managing user API keys and service ID API keys
- IBM Cloud documentation: Auditing access policies
- IBM Cloud documentation: About security groups (VPC)
- IBM Cloud documentation: About Key Protect
- IBM Cloud documentation: About Hyper Protect Crypto Services
- IBM Cloud documentation: Allowing public access to Cloud Object Storage buckets
- IBM Cloud documentation: About Activity Tracker Event Routing
- IBM Cloud documentation: Getting started with IBM Cloud Logs
- IBM: Now Available: IBM Cloud Security and Compliance Center Workload Protection
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.