aws-sts-gap

Compare AWS STS IAM policies between OpenShift versions and generate reports.

12|Updated Mar 6, 2026

Search Tags:#aws #iam #policy analysis #openshift #sts

Ready to run

npx skills add https://github.com/openshift-online/rosa-gap-analysis --skill aws-sts-gap

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: aws-sts-gap
Source: https://github.com/openshift-online/rosa-gap-analysis/tree/main/skills/aws-sts-gap
Command: npx skills add https://github.com/openshift-online/rosa-gap-analysis --skill aws-sts-gap

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, oc, jq, PyYAML, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies gaps in AWS STS IAM policies between different OpenShift versions, helping to ensure that IAM permissions are correctly configured before upgrades.

Core Features & Use Cases

Policy Gap Analysis: Compares AWS STS IAM policies across OpenShift versions to identify new, removed, or changed permissions.
Automated Reporting: Generates comprehensive HTML and JSON reports detailing policy differences.
Use Case: Before upgrading an OpenShift cluster, use this Skill to analyze AWS STS policies and ensure that the necessary permissions are in place.

Quick Start

Run the gap-aws-sts.py script to analyze AWS STS IAM policy gaps between OpenShift versions.

Frequently Asked Questions about aws-sts-gap

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze AWS STS IAM policy gaps between OpenShift versions before upgrading?▼

To analyze AWS STS IAM policy gaps between OpenShift versions, you can run a script that compares policies at the action and service levels. It flags unexpected permission changes in managed-cluster-config and generates detailed HTML and JSON reports.

What are AWS STS IAM policy gaps in OpenShift and why do they matter?▼

AWS STS IAM policy gaps are missing, removed, or changed permissions between OpenShift versions. Identifying them before an upgrade ensures your cluster has the necessary IAM permissions correctly configured to avoid deployment failures.

Do I need specific CLI tools to compare AWS STS policies across OpenShift versions?▼

Yes, comparing AWS STS policies requires Python3, the oc CLI, jq, and PyYAML. These dependencies are necessary to parse policy data and generate the final HTML and JSON gap analysis reports.

How do I check for unexpected permission changes in OpenShift managed-cluster-config?▼

You can check for unexpected permission changes in managed-cluster-config by running an automated gap analysis. The process evaluates policy actions and services across OpenShift versions, highlighting any unexpected permission modifications in its report.

What is the best way to generate an IAM policy difference report for an OpenShift cluster upgrade?▼

The best way to generate an IAM policy difference report is to use an automated analysis script that compares STS policies across versions. This approach produces comprehensive HTML and JSON outputs detailing new, removed, or changed permissions.

Can I get an HTML report of AWS STS permission changes for OpenShift?▼

Yes, you can generate an HTML report of AWS STS permission changes for OpenShift. The analysis script outputs both HTML and JSON formats, providing a comprehensive view of action-level and service-level policy differences between versions.