skills.rest
richardnroman
richardnromanCOMMUNITY
Explore all skills by this author →
GitHub

aws-iam

Generates least-privilege IAM policies and corrects common IAM configuration pitfalls.

Updated Jul 21, 2026
Search Tags:#security#aws#cloud#iam#least privilege#policy generation#trust policy
One-click install
npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill aws-iam-richardnroman
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-iam
Source: https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform/tree/main/.agents/skills/aws-iam
Command: npx skills add https://github.com/richardnroman/Synthetic-Data-Exchange-Licensing-Platform --skill aws-iam-richardnroman

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires iam-policy-autopilot, uv, and includes references (resource) components.

What problem does it solve? AI agents frequently produce incorrect IAM policies — hallucinated action names, missing cross-service permissions, malformed trust policies, and unsafe condition operators. This Skill provides verified corrections for common IAM mistakes plus structured workflows for role management and least-privilege policy generation. ## Core Features & Use Cases - Deterministic Policy Generation: Routes source code (Python, Go, TypeScript, JavaScript, Java) through the iam-policy-autopilot static analysis tool instead of manual policy construction, with a service authorization reference fallback for unsupported languages. - IAM Role Management: Structured workflows for creating and maintaining service roles and execution roles, including trust policies with aws:SourceArn/aws:SourceAccount confused deputy protection. - Verified Edge Cases: Documented corrections for STS session limits, Organizations quirks, SAML specifics, CloudTrail logging behavior, and ForAnyValue/ForAllValues Null-check patterns. - Use Case: A developer pastes a Python Lambda handler using boto3 and asks for an execution role policy. The Skill mandates running uvx iam-policy-autopilot@latest generate-policies with discovered account/region flags, producing a scoped policy without hallucinated actions like s3:CopyObject. ## Quick Start Ask the agent to generate a least-privilege IAM policy from your application source code or to create a service role for an AWS resource you are provisioning.

Frequently Asked Questions about aws-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate a least-privilege IAM policy from my source code?▼

Run `uvx iam-policy-autopilot@latest generate-policies` with absolute paths to your source files, plus --region and --account flags when known. It supports Python (boto3), Go SDK v2, TypeScript/JavaScript SDK v3, and Java SDK v2, producing policies via deterministic static analysis of AWS SDK calls.

How do I create an IAM service role with a correct trust policy?▼

Use the service principal of the service that calls sts:AssumeRole (e.g., glue.amazonaws.com) and add confused deputy conditions: aws:SourceAccount with your account ID and aws:SourceArn with the specific resource ARN. The trust policy goes in AssumeRolePolicyDocument, separate from the permissions policy.

Why does my ForAnyValue deny statement not block requests?▼

ForAnyValue evaluates to false when the context key is absent, so requests missing the key bypass the deny. Add a separate Deny statement with a Null condition (`"Null": {"<key>": "true"}`) on the same key to cover absent-key requests.

Which languages does iam-policy-autopilot support for policy generation?▼

Autopilot supports Python (boto3/botocore), Go (SDK v2), TypeScript and JavaScript (SDK v3), and Java (SDK v2). For unsupported languages like Rust, C#, PHP, or Ruby, fall back to querying the service authorization reference to map API operations to IAM actions.

Why is s3:CopyObject not working as an IAM action?▼

s3:CopyObject is an API operation name, not an IAM action. The CopyObject operation requires s3:PutObject on the destination and s3:GetObject on the source. Always verify action names against the service authorization reference instead of guessing from API names.

What are the limitations of the Autopilot policy generation path?▼

Autopilot produces identity-based policies only — it does not support resource-based policies, SCPs, RCPs, or permission boundaries. Runtime-determined resource names cannot be predicted statically; use --tfstate or --tf-dir for deployed resource ARNs.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.3k

exploring-data-catalog

Inventory AWS data assets across Glue, S3 Tables, Redshift-federated, and Iceberg catalogs.

Official
Advanced
YukiIto1999YukiIto1999

securing-aws-lambda-execution-roles

Audit AWS Lambda execution roles and generate least-privilege IAM policies.

Community
Advanced
hoodinihoodini
262

aws-account-management

Automate AWS account, organization, IAM, and billing management.

Community
Advanced
thehivegroup-aithehivegroup-ai

aws-infra-standards

Review AWS infrastructure plans and CloudFormation templates for deployment readiness.

Official
Intermediate