Skills aws-iam-best-practices
📦
aws-iam-best-practices
Content revision r2 Safe ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Harden AWS IAM Access with Least Privilege
Overly broad IAM access increases cloud security risk and complicates audits. This skill provides focused checks, policy guidance, and hardening steps for AWS identities.
Supports: Claude Codex Code(CC)
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "aws-iam-best-practices" from https://skillstore.io/skills/sickn33-aws-iam-best-practices.md and its manifest at https://skillstore.io/api/skills/sickn33-aws-iam-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "aws-iam-best-practices". Review a role that allows every S3 action on every resource.
Expected outcome:
- High priority: the role grants unrestricted S3 actions and resources.
- Replace broad access with required object and bucket actions for named resources.
- Validate expected workflows with the IAM Policy Simulator before deployment.
Using "aws-iam-best-practices". Help prepare a quarterly IAM access review.
Expected outcome:
- Check MFA coverage, credential age, unused users, unused roles, and external trust relationships.
- Record owners, business purpose, last activity, remediation decision, and approval evidence.
- Test removals in a non-production environment and retain a rollback plan.
Using "aws-iam-best-practices". Create guidance for an S3 upload role.
Expected outcome:
- Limit access to required upload and listing actions.
- Restrict resources to the target bucket and approved prefix.
- Add applicable encryption, network, identity, and session conditions.
Security Audit
Safev5 • 7/23/2026 Open versioned report
Most static alerts are false positives caused by Markdown fences, official AWS links, documentation ranges, and read-only audit examples. The access-key creation example has a real cloud-side effect, and the predictable temporary MFA QR path can expose sensitive bootstrap material.
1
Files scanned
403
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Shell command substitution
NEW_KEY=$(aws iam create-access-key --user-name "$USER")
This command creates a new long-term AWS access key and places the credential response in a shell variable. Execution changes the account and produces secret material.
Medium
Temp directory access
--outfile /tmp/qr.png \
The example writes an MFA bootstrap QR to predictable /tmp/qr.png. On shared systems, insecure permissions or filename reuse can expose the MFA seed.
Risk Factors
⚙️ External commands (31)
SKILL.md:42-69 SKILL.md:69-73 SKILL.md:73-95 SKILL.md:95-99 SKILL.md:99-128 SKILL.md:128-132 SKILL.md:132-157 SKILL.md:157-163 SKILL.md:163-187 SKILL.md:187-191 SKILL.md:191-207 SKILL.md:207-211 SKILL.md:211-230 SKILL.md:230-234 SKILL.md:234-253 SKILL.md:253-287 SKILL.md:287-366 SKILL.md:366-388 SKILL.md:388-391 SKILL.md:51-52 SKILL.md:53-54 SKILL.md:63-64 SKILL.md:81-82 SKILL.md:83-84 SKILL.md:107 SKILL.md:119 SKILL.md:145-146 SKILL.md:42-69 SKILL.md:73-95 SKILL.md:99-128 SKILL.md:132-157
🌐 Network access (5)
📁 Filesystem access (1)
🔑 Env variables (1)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-aws-iam-best-practices?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-aws-iam-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-aws-iam-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-aws-iam-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). aws-iam-best-practices security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5BibTeX citation
@techreport{sickn33-sickn33-aws-iam-best-practices-2026,
author = {sickn33},
title = {aws-iam-best-practices security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "aws-iam-best-practices security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-aws-iam-best-practices/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-aws-iam-best-practices:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: High 55
Architecture
85
Maintainability
87
Content
68
Community
83
Spec Compliance
What You Can Build
Review an application role
Assess an application role for wildcard permissions, broad resources, missing conditions, and unnecessary actions.
Prepare an IAM audit
Collect focused checks for MFA coverage, old keys, unused roles, inline policies, and external trusts.
Design least privilege access
Draft constrained IAM access for a workload, then identify assumptions and required simulator tests.
Try These Prompts
Explain IAM risks
Explain the main AWS IAM risks for a small team and provide a prioritized review checklist.
Review a policy
Review this IAM policy for excessive permissions, wildcard resources, missing conditions, and privilege escalation paths. Explain each recommended change.
Plan account hardening
Create an IAM hardening plan for this account summary. Prioritize MFA, stale credentials, trust policies, monitoring, and least privilege.
Design and validate access
Design least privilege access for this workload. State assumptions, narrow actions and resources, add conditions, and define simulator and rollback tests.
Best Practices
- Use read-only discovery first, then require explicit approval before any IAM change.
- Replace placeholders and validate every policy against real workloads with Access Analyzer and the IAM Policy Simulator.
- Prefer short-lived role sessions, MFA, centralized logging, and documented ownership over long-term access keys.
Avoid
- Do not run account-wide mutation commands from unreviewed examples.
- Do not accept wildcard actions or resources without a documented and tested requirement.
- Do not store access keys, MFA seeds, or policy exports in shared temporary files.
Frequently Asked Questions
Does this skill connect to my AWS account?
No. Live checks require your configured AWS environment and explicit authorization to run AWS CLI or Boto3 operations.
Can it produce a complete IAM policy?
It can draft policies, but you must provide resource details and validate behavior with AWS tools before deployment.
Does it change IAM resources automatically?
The skill includes change examples, but state-changing commands should run only after explicit approval and review.
Can it find privilege escalation paths?
It can review suspicious permission combinations, but comprehensive analysis requires complete policy, boundary, SCP, trust, and resource-policy context.
Which AWS tools support validation?
Use IAM Access Analyzer, the IAM Policy Simulator, CloudTrail, credential reports, and environment-specific tests.
Is the guidance suitable for production?
Use it as review guidance. Production changes require peer approval, staged testing, monitoring, and a rollback plan.