Configure AWS IAM roles, policies, and OIDC federation with least-privilege permissions.
npx skills add https://github.com/ToanPV90/dotfiles --skill aws-iam-toanpv90
Please help me install this Agent Skill. Skill: aws-iam Source: https://github.com/ToanPV90/dotfiles/tree/main/agents/.agents/skills/aws-iam Command: npx skills add https://github.com/ToanPV90/dotfiles --skill aws-iam-toanpv90
aws-iam helps prevent over-permissioned AWS identities by guiding you to design, implement, and validate secure IAM users, roles, policies, and federation with least-privilege and strong guardrails.
Use the aws-iam skill to generate the trust policy and role permissions for a GitHub Actions OIDC deployment into a specified AWS role.
High-intent search queries and answers about installing and using this skill.
GitHub Actions OIDC federation replaces static AWS keys by configuring an IAM role trust policy for the GitHub OIDC provider, allowing short-lived credential assumption via AssumeRoleWithWebIdentity. You define the trust relationship, attach least-privilege permissions, and validate the setup using IAM Access Analyzer.
Least-privilege IAM roles for Lambda and ECS are created by scoping Action and Resource elements explicitly in inline or managed policies. You restrict permissions to only required service actions, attach permission boundaries as guardrails, and verify no unintended access exists through IAM Access Analyzer policy simulation.
Cross-account access uses an IAM trust policy granting another account permission to assume a role, secured with an ExternalId condition key. This prevents confused deputy problems by requiring the assuming account to provide the unique ExternalId token during the assume-role request for identity verification.
IAM Access Analyzer validates permission boundaries and policy trust failures by generating findings on resources accessible from outside the zone of trust. You run policy simulations to test effective permissions, review credential reports for active keys, and identify over-permissioned resource-scoped policies.
AssumeRoleWithWebIdentity in CI/CD pipelines fails when the IAM trust policy conditions do not match the OIDC token claims, such as incorrect repository or branch mappings. You resolve this by aligning the role trust policy string conditions with the exact GitHub Actions workflow OIDC provider configuration.
heaptracetechnologyDraft least-privilege IAM policies for AWS services with explicit actions and conditions.
rajitsahaAudit GCP infrastructure for IAM, firewall, storage, and container misconfigurations.
markus41Provision and manage AWS infrastructure via CLI, Boto3, and Terraform.
DCx7C5Aggregate cloud misconfigurations from AWS Security Hub, Azure Defender, and open-source tools.
