📦
content-creator
88Create Brand-Consistent Marketing Content
Marketing teams need content that stays consistent across channels. This skill helps plan, write, analyze, and optimize content for brand voice and SEO.
Writing & Content View
Skills aws-iam-best-practices
📦
aws-iam-best-practices
Content revision r2 Safe ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Harden AWS IAM Access with Least Privilege
Overly broad IAM access increases cloud security risk and complicates audits. This skill provides focused checks, policy guidance, and hardening steps for AWS identities.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "aws-iam-best-practices" from https://skillstore.io/skills/sickn33-aws-iam-best-practices.md and its manifest at https://skillstore.io/api/skills/sickn33-aws-iam-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "aws-iam-best-practices". Review a role that allows every S3 action on every resource.
Expected outcome:
- High priority: the role grants unrestricted S3 actions and resources.
- Replace broad access with required object and bucket actions for named resources.
- Validate expected workflows with the IAM Policy Simulator before deployment.
Using "aws-iam-best-practices". Help prepare a quarterly IAM access review.
Expected outcome:
- Check MFA coverage, credential age, unused users, unused roles, and external trust relationships.
- Record owners, business purpose, last activity, remediation decision, and approval evidence.
- Test removals in a non-production environment and retain a rollback plan.
Using "aws-iam-best-practices". Create guidance for an S3 upload role.
Expected outcome:
- Limit access to required upload and listing actions.
- Restrict resources to the target bucket and approved prefix.
- Add applicable encryption, network, identity, and session conditions.
Security Audit
Safev5 • 7/23/2026 Open versioned report
Most static alerts are false positives caused by Markdown fences, official AWS links, documentation ranges, and read-only audit examples. The access-key creation example has a real cloud-side effect, and the predictable temporary MFA QR path can expose sensitive bootstrap material.
1
Files scanned
403
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
NEW_KEY=$(aws iam create-access-key --user-name "$USER")
This command creates a new long-term AWS access key and places the credential response in a shell variable. Execution changes the account and produces secret material.
Medium
Temp directory access
--outfile /tmp/qr.png \
The example writes an MFA bootstrap QR to predictable /tmp/qr.png. On shared systems, insecure permissions or filename reuse can expose the MFA seed.
Risk Factors
⚙️ External commands (31)
SKILL.md:42-69 SKILL.md:69-73 SKILL.md:73-95 SKILL.md:95-99 SKILL.md:99-128 SKILL.md:128-132 SKILL.md:132-157 SKILL.md:157-163 SKILL.md:163-187 SKILL.md:187-191 SKILL.md:191-207 SKILL.md:207-211 SKILL.md:211-230 SKILL.md:230-234 SKILL.md:234-253 SKILL.md:253-287 SKILL.md:287-366 SKILL.md:366-388 SKILL.md:388-391 SKILL.md:51-52 SKILL.md:53-54 SKILL.md:63-64 SKILL.md:81-82 SKILL.md:83-84 SKILL.md:107 SKILL.md:119 SKILL.md:145-146 SKILL.md:42-69 SKILL.md:73-95 SKILL.md:99-128 SKILL.md:132-157
🌐 Network access (5)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-aws-iam-best-practices?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-aws-iam-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-aws-iam-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-aws-iam-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). aws-iam-best-practices security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5BibTeX citation
@techreport{sickn33-sickn33-aws-iam-best-practices-2026,
author = {sickn33},
title = {aws-iam-best-practices security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "aws-iam-best-practices security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-aws-iam-best-practices:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Review an application role
Assess an application role for wildcard permissions, broad resources, missing conditions, and unnecessary actions.
Prepare an IAM audit
Collect focused checks for MFA coverage, old keys, unused roles, inline policies, and external trusts.
Design least privilege access
Draft constrained IAM access for a workload, then identify assumptions and required simulator tests.
Try These Prompts
Explain IAM risks
Explain the main AWS IAM risks for a small team and provide a prioritized review checklist.
Review a policy
Review this IAM policy for excessive permissions, wildcard resources, missing conditions, and privilege escalation paths. Explain each recommended change.
Plan account hardening
Create an IAM hardening plan for this account summary. Prioritize MFA, stale credentials, trust policies, monitoring, and least privilege.
Design and validate access
Design least privilege access for this workload. State assumptions, narrow actions and resources, add conditions, and define simulator and rollback tests.
Best Practices
- Use read-only discovery first, then require explicit approval before any IAM change.
- Replace placeholders and validate every policy against real workloads with Access Analyzer and the IAM Policy Simulator.
- Prefer short-lived role sessions, MFA, centralized logging, and documented ownership over long-term access keys.
Avoid
- Do not run account-wide mutation commands from unreviewed examples.
- Do not accept wildcard actions or resources without a documented and tested requirement.
- Do not store access keys, MFA seeds, or policy exports in shared temporary files.
Frequently Asked Questions
Does this skill connect to my AWS account?
No. Live checks require your configured AWS environment and explicit authorization to run AWS CLI or Boto3 operations.
Can it produce a complete IAM policy?
It can draft policies, but you must provide resource details and validate behavior with AWS tools before deployment.
Does it change IAM resources automatically?
The skill includes change examples, but state-changing commands should run only after explicit approval and review.
Can it find privilege escalation paths?
It can review suspicious permission combinations, but comprehensive analysis requires complete policy, boundary, SCP, trust, and resource-policy context.
Which AWS tools support validation?
Use IAM Access Analyzer, the IAM Policy Simulator, CloudTrail, credential reports, and environment-specific tests.
Is the guidance suitable for production?
Use it as review guidance. Production changes require peer approval, staged testing, monitoring, and a rollback plan.
Developer Details
Author
sickn33License
MIT
Skillstore revision
r2
Version notice
The author did not declare a version.
Ref
86d877f219e2131f05dd5b37c5e329c71c7b8ec4
Maintenance freshness
7/26/2026
Usage
6 downloads · 90 views
File structure
📄 SKILL.md
More from sickn33
View all📦
prompt-engineering-patterns
85Improve LLM Prompts With Proven Patterns
Inconsistent prompts waste time and make AI outputs hard to trust. This skill guides prompt design with reusable patterns, examples, evaluation steps, and optimization workflows.
Productivity View
📦
senior-architect
81Review Architecture Workflows and Project Paths
Architecture reviews need a consistent starting point and clear project boundaries. This skill provides workspace-scoped tool templates, command examples, and generic design references.
Coding & Development View
📦
senior-fullstack
81Review Fullstack Project Foundations
Fullstack project setup can require many tools and checks. This skill provides basic local wrappers, common commands, and general engineering guidance.
Coding & Development View
📦
prompt-engineer
81Optimize AI Prompts With Prompt Engineer
Writing clear prompts is hard when goals are vague or complex. This skill turns rough requests into structured prompts using proven prompt frameworks.
Productivity View
📦
product-manager-toolkit
80Prioritize Product Work With Research Insights
Product teams need faster ways to rank features, synthesize interviews, and document decisions. This skill provides RICE scoring, interview analysis, and PRD templates for structured planning.
Productivity View
Related Skills
View all📦
azure-role-selector
79Select Least-Privilege Azure Roles
by 7Spade
Azure role decisions can grant too much access when requirements are unclear. This skill maps desired permissions to minimal roles and assignment guidance.
Security & Compliance View
📦
azure-rbac
80Choose Least-Privilege Azure RBAC Roles
by microsoft
Selecting an Azure role with excessive permissions increases security risk. This skill recommends minimal roles and prepares Azure CLI and Bicep assignments.
Security & Compliance View
📦
firestore-security-rules-auditor
78Audit Firestore Security Rules
by firebase
Firestore rules often miss update bypasses, ownership checks, and validation gaps. This skill guides Claude, Codex, or Claude Code through a focused security review.
Security & Compliance View
📦
cultural-review
78Review Cultural Data Practices
by Acurioustractor
Sensitive stories can be mishandled when consent, access, and ownership rules are unclear. This skill guides reviews using OCAP, sensitivity levels, and approval workflows.
Security & Compliance View
📦
security-management
78Audit UniFi Security Policies
by DataKnifeAI
UniFi teams need clear reviews of zones, ACLs, and guest access. This skill guides Claude, Codex, and Claude Code through audits, policy checks, and compliance-ready summaries.
Security & Compliance View
📦
delon-acl
77Secure Angular Permissions with @delon/acl
by 7Spade
Angular teams need consistent role and ability checks across routes, components, and data access. This skill shows practical @delon/acl patterns for guards, UI visibility, and server-side validation.
Security & Compliance View