What problem does it solve? Cloud identities accumulate far more permissions than they use — wildcard policies, convenience admin roles, and shared service accounts create blast radius that attackers and accidents exploit. This Skill provides a structured granted-versus-used review workflow that shrinks permissions safely without breaking production. ## Core Features & Use Cases - Granted-vs-Used Diffing: Ranks identities by blast radius and compares granted permissions against actual usage from CloudTrail, GCP IAM Recommender, or database query logs. - Four Classic Over-Grant Sweep: Systematically eliminates wildcards, managed convenience roles, standing human admin, and shared service accounts. - Safe Shrink Sequence: Applies reductions via dry-run, staged rollout, and AccessDenied monitoring, with schedule checks to avoid deleting quarterly or disaster-recovery permissions. - Escalation Graph Analysis: Traces transitive privilege paths like iam:PassRole and CI pipeline writes that scoped-everything audits miss. - Use Case: After a leaked access key incident, audit the CI deploy role holding AdministratorAccess, generate a scoped replacement policy from 90 days of usage data, and roll it out with zero unexplained AccessDenied events. ## Quick Start Audit our AWS IAM roles for least privilege and tell me which permissions can be safely removed based on actual usage.
