skills.rest
obispobruno
obispobrunoCOMMUNITY
Explore all skills by this author →
GitHub

aws-iam

Generates IAM policies and roles with verified corrections for common AWS IAM pitfalls.

1|Updated Aug 1, 2024
Search Tags:#security#aws#cloud#terraform#iam#least privilege#policy generation
One-click install
npx skills add https://github.com/obispobruno/dotfiles --skill aws-iam-obispobruno
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-iam
Source: https://github.com/obispobruno/dotfiles/tree/main/dot_agents/skills/aws-iam
Command: npx skills add https://github.com/obispobruno/dotfiles --skill aws-iam-obispobruno

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? AI agents frequently produce incorrect IAM policies and roles — wrong action names, missing confused deputy protections, unsafe condition operators, and hallucinated API behaviors. This Skill provides verified corrections for these edge cases plus structured workflows for role management and baseline policy generation. ## Core Features & Use Cases - Verified IAM Edge Cases: Corrections for STS session limits, Organizations quirks, SAML/MFA specifics, CloudTrail logging behavior, and policy evaluation subtleties like ForAnyValue/ForAllValues Null checks. - Role Management Workflows: Create and maintain service roles and execution roles with proper trust policies, aws:SourceArn/aws:SourceAccount confused deputy conditions, and scoped permissions. - Policy Generation: Generate baseline IAM policies from application source code or a Terraform plan JSON using iam-policy-autopilot, with a Service Authorization Reference fallback for unsupported languages. - Use Case: A developer provides Python source code using boto3 and asks for a least-privilege IAM policy — the Skill routes to the Autopilot tool with correct flags instead of hand-writing a potentially hallucinated policy. ## Quick Start Ask the assistant to generate an IAM policy from your application source code or Terraform plan JSON, or to create a service role for an AWS resource like a Glue crawler or Lambda function.

Frequently Asked Questions about aws-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an IAM policy from application source code?▼

Run the iam-policy-autopilot tool via uvx with your source files as arguments: uvx iam-policy-autopilot@latest generate-policies with absolute file paths. It performs deterministic static analysis of AWS SDK calls in Python, Go, TypeScript/JavaScript, and Java to produce minimal identity-based policies.

How do I create an IAM policy for a Terraform deployment?▼

Produce a plan JSON with terraform plan -out=plan.tfplan followed by terraform show -json, then pass the plan JSON to iam-policy-autopilot. Native .tf files are not supported as direct input — the plan JSON maps resource changes to the SDK operations the AWS provider performs.

Why does my Deny statement with ForAnyValue not block requests?▼

ForAnyValue evaluates to false when the context key is absent, so requests missing the key bypass the deny entirely. Add a separate Deny statement with a Null condition set to true on the same context key to cover missing-key requests.

What trust policy conditions prevent confused deputy attacks?▼

Include both aws:SourceArn and aws:SourceAccount conditions in the role's trust policy. Use the specific resource ARN when known and the full account ID, restricting which resource and account can trigger the service's sts:AssumeRole call.

Which languages does IAM policy generation from code support?▼

Confirmed supported languages are Python (boto3), Go (SDK v2), TypeScript/JavaScript (SDK v3), and Java (SDK v2). Unsupported languages like Rust, C#, PHP, and Ruby fall back to the Service Authorization Reference path for manual action mapping.

What are the limitations of IAM policy autopilot?▼

Autopilot only generates identity-based policies, not resource-based policies, and only detects direct AWS SDK calls — wrapper functions without SDK usage produce no actions. Without --service-hints, ambiguous method names may match multiple services and produce overly broad policies.

Related Skills

Explore More Software Engineering Skills→
subimagesecsubimagesec

connect-aws

Deploy the SubImageScanRole IAM role to connect AWS accounts to SubImage.

Official
Advanced
ToanPV90ToanPV90

aws-iam

Configure AWS IAM roles, policies, and OIDC federation with least-privilege permissions.

Community
Advanced
mreferremreferre

setting-up-cloudtrail-multi-region

Configure multi-region AWS CloudTrail trails with S3 and CloudWatch Logs delivery.

Community
Advanced
d-padmanabhand-padmanabhan
15

aws-iam

Diagnose AWS IAM AccessDenied errors across policy layers.

Community
Advanced