# Harden AWS IAM Access with Least Privilege

Overly broad IAM access increases cloud security risk and complicates audits. This skill provides focused checks, policy guidance, and hardening steps for AWS identities.

## Install

```bash
npx skillstore add sickn33/aws-iam-best-practices
```

## Metadata

- Status: approved
- Slug: sickn33-aws-iam-best-practices
- Skillstore revision: r2
- Version status: missing
- Tree hash: fba5cbe97e90c985c44a73469564413e386a6d158a1b118eba686c9ece2608f1
- Author: sickn33
- GitHub username: sickn33
- License: MIT
- Repository: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security/aws-iam-best-practices
- Ref: 86d877f219e2131f05dd5b37c5e329c71c7b8ec4
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, filesystem, env\_access
- Quality score: 78
- Quality tier: bronze
- Public page: https://skillstore.pages.dev/skills/sickn33-aws-iam-best-practices
- Manifest: https://skillstore.pages.dev/api/skills/sickn33-aws-iam-best-practices/manifest

## Capabilities

- Reviews IAM policy concepts for wildcard actions, inline policies, and excessive permissions.
- Provides AWS CLI checks for MFA status, old access keys, unused roles, and external trust relationships.
- Drafts policy examples for S3 access, MFA enforcement, time limits, and IP restrictions.
- Supplies a Boto3 audit example for users, access keys, and local managed policies.
- Organizes IAM hardening work into user, policy, role, and monitoring checklists.

## Use Cases

- Review an application role: Assess an application role for wildcard permissions, broad resources, missing conditions, and unnecessary actions.
- Prepare an IAM audit: Collect focused checks for MFA coverage, old keys, unused roles, inline policies, and external trusts.
- Design least privilege access: Draft constrained IAM access for a workload, then identify assumptions and required simulator tests.

## Prompt Templates

### Explain IAM risks

```
Explain the main AWS IAM risks for a small team and provide a prioritized review checklist.
```

### Review a policy

```
Review this IAM policy for excessive permissions, wildcard resources, missing conditions, and privilege escalation paths. Explain each recommended change.
```

### Plan account hardening

```
Create an IAM hardening plan for this account summary. Prioritize MFA, stale credentials, trust policies, monitoring, and least privilege.
```

### Design and validate access

```
Design least privilege access for this workload. State assumptions, narrow actions and resources, add conditions, and define simulator and rollback tests.
```

## Limitations

- Requires configured AWS credentials and sufficient IAM permissions for live checks.
- Examples contain placeholders and must be adapted to the account, region, resources, and approved network ranges.
- Some commands change IAM state and require explicit authorization, testing, and rollback planning.
- Generated policies still require validation with AWS tools and environment-specific security review.

## Best Practices

- Use read-only discovery first, then require explicit approval before any IAM change.
- Replace placeholders and validate every policy against real workloads with Access Analyzer and the IAM Policy Simulator.
- Prefer short-lived role sessions, MFA, centralized logging, and documented ownership over long-term access keys.

## Anti Patterns

- Do not run account-wide mutation commands from unreviewed examples.
- Do not accept wildcard actions or resources without a documented and tested requirement.
- Do not store access keys, MFA seeds, or policy exports in shared temporary files.

## Security Audit

- Audited at: 2026-07-23T20:59:16.072\+00:00
- Summary: Most static alerts are false positives caused by Markdown fences, official AWS links, documentation ranges, and read-only audit examples. The access-key creation example has a real cloud-side effect, and the predictable temporary MFA QR path can expose sensitive bootstrap material.

## Stats

- Views: 90
- Downloads: 9
- Favorites: 0
- Popularity score: 0