The first day in a cloud account
You are allowed to read one account. The day is whose account it is, one look at the audit log, one role you can explain, and a list of what you did not change.
Whose account
Write the account name and who owns it. A lab account, a sandbox, and a production payer are not the same thing. If the permission says read, you read. You do not create a key “to see how it looks.”
If a key is already sitting in a ticket or a repository, that is a different page: treat it as copied, revoke it, and then read what it did. Do not paste it into your notes.
The audit log
Ask one question of the log. Who called what, when, and from where. The detection workbench is the log you should already be keeping. The log lab is that question on a sample, not on a live account you were not given.
If the log is missing, write that down. A missing log is part of the note. Do not fill the gap with a guess about what probably happened.
One role you can explain
Pick one role or one policy and say what a single request is allowed to do. The IAM lab walks a request through the layers that decide allow or deny. Stop when you can say which layer decided, and what the role does not allow.
“It is admin” is not an explanation. Name the action you checked, and the action you did not check.
What you do not change on day one
Do not widen a policy to make a task easier. Do not create a long-lived key. Do not turn off a log. The finding, if you have one, is what the account allows and what the log shows. The change can wait until someone who owns the account agrees.
The cloud path on the careers page is the longer list of lessons. This page is the shape of the day: one account, one log question, one role, and a note that says what you left alone.