aws-iam
Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Use alongside documentation when working with IAM roles, policies, STS, or Organizations. Do NOT use for non-IAM authorization like Cognito user-pool policies or app-level RBAC.
Security Assessment
About aws-iam
The aws-iam skill provides verified corrections for IAM behaviors that AI agents frequently get wrong, including policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. It is meant to be used alongside official documentation when working with IAM roles, policies, STS, or Organizations, and explicitly not for non-IAM authorization like Cognito user pools or application-level RBAC.
It is a curated set of verified edge cases rather than a comprehensive guide, covering CloudTrail logging locations, STS restrictions and role-chaining limits, Organizations account-removal order and policy-delegation specifics, SDK quirks (such as Boto3 IAM access-key methods and the five managed-policy version limit), SAML assertion details, MFA behaviors, and policy-evaluation subtleties including vacuous-truth ForAllValues conditions and privilege-escalation patterns such as iam:PassRole with overly broad resources. Throughout, it advises verifying specific limits, quotas, and API names against official AWS documentation rather than relying on pre-training.
It is most useful as a correctness reference for engineers and agents authoring or debugging IAM policies, trust relationships, and STS or Organizations configurations, where subtle edge cases commonly cause errors or security gaps.
FAQ
What is this skill for?
Verified corrections for IAM edge cases that AI agents often get wrong (policy evaluation, trust policies, STS limits, Organizations, SAML/MFA), used alongside official AWS documentation.
When should it not be used?
For non-IAM authorization such as Cognito user-pool policies or application-level RBAC.
Is it a complete IAM guide?
No. It is a focused set of verified edge cases; for full guidance you should consult official AWS documentation and verify specific limits, quotas, and API names there.
What kinds of edge cases does it cover?
Examples include role-chaining's one-hour limit, GetSessionToken restrictions, Organizations account-removal order, Boto3 access-key methods, ForAllValues vacuous truth, and iam:PassRole privilege escalation.
Does it address security risks?
Yes. It highlights privilege-escalation actions and patterns, such as broad iam:PassRole combined with compute-service create/update, and how to scope them down.
Install aws-iam
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
aws/agent-toolkit-for-aws