skills.rest
sakicodes
sakicodesCOMMUNITY
Explore all skills by this author →
GitHub

aws-iam

Provides verified corrections for common AWS IAM policy, STS, and Organizations misconceptions.

Updated Jul 1, 2026
Search Tags:#security#aws#cloud#iam#organizations#policy evaluation#sts
One-click install
npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill aws-iam-sakicodes
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: aws-iam
Source: https://github.com/sakicodes/BuildFestHackathon26/tree/main/.agents/skills/aws-iam
Command: npx skills add https://github.com/sakicodes/BuildFestHackathon26 --skill aws-iam-sakicodes

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? AI agents frequently produce incorrect answers about AWS IAM edge cases such as policy evaluation quirks, STS session limits, trust policy requirements, and Organizations behaviors, leading to broken configurations and security gaps. ## Core Features & Use Cases - Verified Edge-Case Corrections: Documents confirmed behaviors for CloudTrail logging, STS session restrictions, role chaining limits, and SAML federation specifics. - Policy Evaluation Guidance: Explains ForAllValues vacuous truth, PassRole privilege escalation paths, permissions boundary bypasses, and the eight privilege escalation actions. - SDK and Service Specifics: Covers boto3 IAM method names, Organizations exception names, Redshift Serverless trust policies, and OIDC thumbprint changes. - Use Case: When writing an IAM policy that restricts EC2 tagging or troubleshooting a cross-account AssumeRole failure into an opt-in region, consult this Skill to avoid known pitfalls before deploying. ## Quick Start Ask the agent to review your IAM policy or answer an IAM question using the aws-iam skill to check for known pitfalls.

Frequently Asked Questions about aws-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent privilege escalation with iam:PassRole?▼

Scope the PassRole Resource to specific role ARNs or an IAM path instead of using a wildcard. Optionally constrain it with iam:PassedToService or iam:AssociatedResourceArn conditions, since PassRole with Resource * plus compute service access allows escalation to any passable role.

Why does ForAllValues allow requests with missing tag keys?▼

ForAllValues evaluates to true when the context key is empty or missing due to vacuous truth. Add a Null condition set to false on the same context key, such as aws:TagKeys, to require the key to be present and non-null.

What is the maximum session duration for IAM role chaining?▼

Role chaining sessions are limited to a maximum of one hour. This applies when using temporary credentials from one assumed role to assume another role, regardless of the configured maximum session duration on the target role.

Can I remove a suspended account from AWS Organizations?▼

No, suspended or closed accounts cannot be removed from an organization until they are permanently closed, which takes approximately 90 days. Remove the account from the organization first, then close it.

Does boto3 IAM AccessKey have an update method?▼

No, boto3 IAM AccessKey objects only expose activate, deactivate, and delete methods. There is no update method, so use activate or deactivate to change an access key status.

Related Skills

Explore More Software Engineering Skills→
balsm-healthbalsm-health
2

implementing-aws-iam-permission-boundaries

Configure AWS IAM permission boundaries to enforce least privilege on roles and policies using CLI/boto3 workflows.

Official
Advanced
xalgordxalgord
954

securing-aws-lambda-execution-roles

Implements least-privilege IAM execution roles for AWS Lambda functions using Access Analyzer and permission boundaries.

Community
Advanced
bpnrockstarbpnrockstar

cloud-iam-deep

Detect security vulnerabilities in AWS, Azure, and GCP IAM configurations.

Community
Advanced
n4vyshn4vysh
5

aws-iam

Validate AWS IAM edge cases and trust policies against official documentation.

Community
Intermediate