review-access

Automate quarterly AWS IAM access reviews and generate flagged-user reports.

7|2|Updated Apr 3, 2026
One-click install
npx skills add https://github.com/kkmookhey/shasta --skill review-access
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-access
Source: https://github.com/kkmookhey/shasta/tree/main/.claude/skills/review-access
Command: npx skills add https://github.com/kkmookhey/shasta --skill review-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates quarterly IAM access reviews to ensure SOC 2 compliance by identifying risky users, reviewing permissions and activity, and flagging issues for remediation.

Core Features & Use Cases

  • Automated Review: Enumerates users, permissions, MFA status, and console activity to produce a defensible audit.
  • Flagging & Reporting: Highlights risky configurations and generates an audit-ready report for evidence.
  • Use Case: SOC 2 controls CC6.2/CC6.3 require periodic access reviews and traceable artifacts.

Quick Start

Initiate the access review using the configured Python environment to generate and save the audit report.

Frequently Asked Questions about review-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate quarterly IAM access reviews for AWS to ensure SOC 2 compliance?▼

Automated IAM access reviews enumerate AWS users, permissions, MFA status, and console activity to produce an audit-ready report with flagged non-compliant users and remediation recommendations for SOC 2 controls CC6.2 and CC6.3.

What do I need to configure before running an automated AWS access review?▼

Running an AWS access review requires valid AWS credentials and a configured shasta.config.json file specifying the python_cmd to execute the run_access_review and save_access_review workflow.

What specific user risks are flagged during an AWS IAM access review?▼

An AWS IAM access review flags risky configurations by enumerating user permissions, verifying MFA status, and analyzing console activity to identify non-compliant users requiring remediation.

What's the best way to generate an audit-ready report for SOC 2 access reviews?▼

Generating an audit-ready SOC 2 report involves running an automated Python workflow that enumerates IAM users, evaluates permissions and MFA status, and outputs a defensible artifact with flagged issues and remediation recommendations.

Can I use automated access reviews to identify inactive AWS IAM users?▼

Automated access reviews evaluate console activity alongside permissions and MFA status to identify risky and non-compliant users, producing a report that flags these accounts for remediation.

Does the IAM access review workflow output a report I can use as SOC 2 evidence?▼

The IAM access review workflow outputs a defensible audit report containing flagged users and remediation recommendations, serving as traceable artifacts for SOC 2 controls CC6.2 and CC6.3.