skills.rest
dennisvink
dennisvinkCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

aws-iam

Generates IAM policies and corrects common IAM policy, trust, and STS misconfigurations.

Updated Sep 8, 2026
Search Tags:#security#aws#terraform#iam#least privilege#policy generation#trust policy
One-click install
npx skills add https://github.com/dennisvink/yolomancer --skill aws-iam-dennisvink
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-iam
Source: https://github.com/dennisvink/yolomancer/tree/main/skills/aws/core-skills/aws-iam
Command: npx skills add https://github.com/dennisvink/yolomancer --skill aws-iam-dennisvink

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires iam-policy-autopilot, uv, and includes references (resource) components.

What problem does it solve? AI agents and developers frequently produce incorrect IAM configurations — wrong action names, missing confused deputy protections, unsafe condition operators, and over-permissive policies. This Skill provides verified corrections for these pitfalls plus structured workflows for role management and baseline policy generation. ## Core Features & Use Cases - Verified IAM Edge Cases: Corrections for policy evaluation quirks (ForAnyValue/ForAllValues with Null checks), STS session limits, Organizations behaviors, SAML/MFA specifics, and privilege escalation paths like iam:PassRole with wildcard resources. - IAM Role Management: Structured workflows for creating and maintaining service roles and execution roles with proper trust policies, aws:SourceArn/aws:SourceAccount confused deputy conditions, and scoped permissions. - Policy Generation: Generates baseline IAM policies from application source code or a Terraform plan JSON using the deterministic iam-policy-autopilot tool, with a Service Authorization Reference fallback for unsupported languages. - Use Case: A developer pastes Python boto3 code and asks for the minimal IAM policy — the Skill routes to iam-policy-autopilot with correct flags instead of hand-writing a hallucination-prone policy. ## Quick Start Ask the assistant to generate a least-privilege IAM policy from your application source code or Terraform plan JSON, or to review an IAM role trust policy for confused deputy protection.

Frequently Asked Questions about aws-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate an IAM policy from application source code?▼

Run uvx iam-policy-autopilot@latest generate-policies with absolute paths to your source files, plus --region and --account flags for scoped ARNs. It supports Python (boto3), Go SDK v2, TypeScript/JavaScript SDK v3, and Java SDK v2 through deterministic static analysis.

How do I create an IAM policy for a Terraform deployment role?▼

Render the plan with terraform show -json plan.tfplan > plan.json, then pass the plan JSON to iam-policy-autopilot generate-policies. Native .tf files are not accepted directly; the plan JSON maps resource changes to the IAM actions terraform apply requires.

Why does my ForAnyValue deny statement not block requests?▼

ForAnyValue evaluates to false when the context key is absent, so requests missing the key bypass the deny. Add a separate Deny statement with a Null condition on the same key, such as "Null": {"aws:VpceOrgPaths": "true"}.

How do I protect an IAM role trust policy from confused deputy attacks?▼

Include both aws:SourceAccount and aws:SourceArn conditions in the trust policy's sts:AssumeRole statement. Use the specific resource ARN when known and the full account ID, since most major services like Glue, Lambda, and CloudTrail populate these keys.

What languages does iam-policy-autopilot support for policy generation?▼

Confirmed supported languages are Python (boto3), Go (SDK v2), TypeScript/JavaScript (SDK v3), and Java (SDK v2). Confirm current support with generate-policies --help; unsupported languages like Rust, C#, PHP, or Ruby fall back to the service authorization reference.

When should I not use this IAM policy generation approach?▼

Autopilot only produces identity-based policies, so resource-based policies require the service authorization reference path. It also does not cover non-IAM authorization such as Cognito user-pool policies or application-level RBAC.

Related Skills

Explore More Software Engineering Skills→
subimagesecsubimagesec

connect-aws

Deploy the SubImageScanRole IAM role to connect AWS accounts to SubImage.

Official
Advanced
automateyournetworkautomateyournetwork
627

aws-security-audit

Audits AWS IAM configurations and CloudTrail API events for compliance.

Community
Intermediate
jassicsjassics
6

cloud-iam-review

Audit AWS, Azure, and GCP IAM configurations for least privilege risks.

Community
Advanced
awslabsawslabs
15

iam

Design and review AWS IAM policies for least privilege access.

Official
Advanced