AWS Iam
Provides verified corrections for IAM behaviors that AI agents frequently get wrong, ...
Install
npx skills add aws/agent-toolkit-for-aws --skill aws-iam -g -a claude-code -y- Repository
- aws/agent-toolkit-for-aws3.4k
- Category
- AI and agents
- Updated
- 5d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 1,570 tokens
- Runs scripts
- No, instructions only
What it does
Provides verified corrections for IAM behaviors that AI agents frequently get wrong, policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.
AWS IAM, Common Pitfalls
About This Skill
This skill contains verified corrections for things that AI agents frequently get wrong about IAM. It is not a comprehensive IAM guide, for full IAM guidance, search AWS documentation. When answering IAM questions, verify specific claims (limits, quotas, exact API names, edge-case behaviors) against official AWS documentation rather than relying on pre-training. Prefer fetching known documentation URLs over broad searches. Trust official documentation over memory when they conflict.
Common Workflows
Use the best available tool for AWS operations, the AWS MCP server is recommended but not required; AWS CLI or SDK may be used as alternatives. Read reference files only when the conversation requires deeper detail.
-
Read references/aws-iam-role-management.md if the user needs to create, scope, or maintain IAM roles when provisioning or updating AWS resources. Covers service roles, execution roles, trust policies, confused deputy protection, and permission hygiene.
-
Read references/aws-iam-policy-generation.md if the user needs to generate IAM policies, determine required IAM actions for API calls, or understand action-to-operation mappings. CRITICAL: If the user provides application source code (in any language) or a Terraform plan JSON file (
terraform show -jsonoutput), you MUST read this reference, it mandates using iam-policy-autopilot instead of manual policy construction. Uses the programmatic service authorization reference for accurate mappings.
Verified Edge Cases
CloudTrail:
- AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization.
- ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1.
?region=forces specific region.
STS:
