aws-cloudformation-iam_skill

Overview

This skill provides production-ready AWS CloudFormation patterns for creating and managing IAM users, roles, policies, and managed policies. It focuses on implementing least-privilege, permission boundaries, cross-account access, and modular template structure to support secure, repeatable deployments. Use the patterns to standardize IAM infrastructure across environments and teams.

How this skill works

The skill delivers CloudFormation template patterns and examples that define Parameters, Mappings, Conditions, Resources, and Outputs for IAM constructs. It includes ready-made role trust policies, inline and managed policy documents, permission boundary templates, cross-account role patterns using STS, and export/import patterns for cross-stack references. Templates are designed for modularity (nested stacks) and environment-specific configuration via mappings and parameters.

When to use it

• Creating IAM users with programmatic or console access using CloudFormation
• Defining IAM roles for services (Lambda, EC2, ECS, EKS) with correct assume-role policies
• Implementing least-privilege policies and managed policies for teams and services
• Configuring cross-account access with roles, external IDs, and STS
• Applying permission boundaries to limit maximum permissions for developers
• Organizing templates with Parameters, Mappings, Conditions, and nested stacks

Best practices

• Enforce least-privilege by specifying exact actions and resource ARNs rather than wildcards
• Use PermissionsBoundary managed policies to cap effective privileges for IAM principals
• Store sensitive seeds (initial passwords, access keys) in Secrets Manager and reference them in outputs only when necessary
• Validate names and values with parameter constraints and AWS-specific parameter types for stronger template input validation
• Export role and policy ARNs from a core IAM stack and import them into application stacks to centralize identity management
• Require MFA for console users and rotate access keys regularly via parameterized rotation frequency

Example use cases

• Create a Lambda execution role with the minimal managed policies and a trust policy for lambda.amazonaws.com
• Provision developer IAM users with a permissions boundary and a Secrets Manager secret holding initial credentials
• Build a cross-account read role that trusts a specific account root ARN and requires an external ID
• Split IAM resources into nested stacks: users, roles, and policies to enable independent updates and clear ownership
• Import a central execution role ARN into application stacks using Export/Import to avoid duplicating IAM definitions