iam_skill

Overview

This skill helps manage AWS Identity and Access Management (IAM) for users, roles, policies, and permissions. It provides patterns and commands to create service roles, craft least-privilege policies, configure cross-account access, and troubleshoot permission errors. Use it to automate IAM tasks, validate permissions, and enforce secure access controls.

How this skill works

The skill inspects IAM constructs such as identity-based and resource-based policies, trust relationships, managed and inline policies, and permission boundaries. It generates CLI and boto3 examples to create roles, attach policies, and assume roles across accounts. It also guides simulation and debugging steps for AccessDenied issues and highlights key CLI commands and flags for scripting.

When to use it

• Creating service roles for Lambda, EC2, or other AWS services
• Designing or attaching least-privilege custom policies
• Configuring cross-account role assumption and ExternalId protections
• Troubleshooting AccessDenied and AssumeRole failures
• Auditing permissions, running simulations, and reviewing trust policies

Best practices

• Avoid daily use of the root account; use IAM users and roles instead
• Enable MFA for human users and require MFA in sensitive policies
• Apply least privilege and use permission boundaries for delegated admin
• Prefer roles and temporary credentials over long-term access keys
• Enable CloudTrail and IAM Access Analyzer for monitoring and policy validation

Example use cases

• Create a Lambda service role with a trust policy and attach AWS managed policy via CLI or boto3
• Write a tight DynamoDB policy granting GetItem/PutItem/Query to a specific table ARN
• Configure a cross-account role with ExternalId and demonstrate sts:assume-role from the trusting account
• Simulate a principal policy to verify a specific API call and debug AccessDenied errors
• Split large policies into multiple managed policies to work around size limits