skills.rest
Arafly
AraflyCOMMUNITY
Explore all skills by this author →
𝕏@MolokofiXGitHub

iam-access-review

Map effective access and plan reversible permission reductions across cloud and Kubernetes.

1|Updated Jul 17, 2026
Search Tags:#iam#cloud security#least privilege#offboarding#privileged access#access review#kubernetes rbac
One-click install
npx skills add https://github.com/Arafly/sre-playbooks --skill iam-access-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iam-access-review
Source: https://github.com/Arafly/sre-playbooks/tree/main/iam-access-review
Command: npx skills add https://github.com/Arafly/sre-playbooks --skill iam-access-review

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you safely review, audit, and reduce access across cloud, Kubernetes, internal systems, CI/CD, databases, and SaaS when permissions have grown messy, ownership is unclear, or you need to answer who can do what.

Core Features & Use Cases

  • Access inventory and mapping: Builds an effective-access view across human and machine identities, including roles, trusts, bindings, and inherited permissions.
  • Risk identification: Finds stale accounts, shared credentials, wildcard grants, standing admin access, weak break-glass controls, and other privilege-sprawl patterns.
  • Safe revocation planning: Evaluates justification, ownership, recent use, dependencies, and restoration steps before changing access.
  • Use cases: offboarding a user, recertifying privileged access, reducing an overbroad service account, auditing who can touch production, or deciding whether a role can be tightened safely.

Quick Start

Ask the iam-access-review skill to map current effective access for a target system, identify the highest-risk grants, and recommend one safe right-sizing action or a defensible reason not to revoke yet.

Frequently Asked Questions about iam-access-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely reduce standing admin access and enforce least privilege without breaking production?▼

Least privilege enforcement requires mapping effective access, assessing blast radius, and planning reversible revocation steps. You evaluate ownership and recent usage to ensure tightening roles or removing wildcard grants does not disrupt active production dependencies.

What is the best way to audit who can touch production across cloud, Kubernetes, and CI/CD identities?▼

Auditing production access involves building an effective-access inventory across human and machine identities, including roles, trusts, and inherited Kubernetes RBAC bindings. This identifies privilege sprawl, stale accounts, and shared credentials to clarify exactly who can touch production.

How do I offboard a user and remove their access from internal tools and third-party SaaS safely?▼

User offboarding requires identifying all active credentials and role bindings across SaaS, databases, and cloud accounts. You verify recent usage and dependencies before executing a reversible revocation plan to ensure no shared resources or production services are broken.

Does this approach work for recertifying privileged access and shared credentials in Kubernetes RBAC?▼

Kubernetes RBAC recertification is supported by mapping inherited permissions and identifying wildcard grants or standing admin access. The process evaluates justification and recent use to determine if a role can be tightened safely or requires defensible retention.

When should I not revoke an overbroad service account's permissions even if it violates least privilege?▼

You should not revoke access when recent usage indicates active dependencies or when restoration steps are unclear. Safe revocation planning requires confirming ownership and blast radius to avoid breaking production services tied to the service account.

How do I identify stale accounts and shared credentials during an identity and access management review?▼

An identity and access management review identifies stale accounts and shared credentials by mapping effective access and analyzing recent usage patterns. Risk identification reveals standing admin access and weak break-glass controls to prioritize safe right-sizing actions.

Related Skills

Explore More Legal & Compliance Skills→
haxlyshaxlys

k8s-security-policies

Generate and enforce Kubernetes NetworkPolicy, PodSecurityPolicy, and RBAC security policies.

Community
Advanced
KentoShimizuKentoShimizu
7

security-authorization

Enforce least-privilege authorization across APIs, UI actions, and background jobs.

Community
Advanced
KentoShimizuKentoShimizu
7

kubernetes-security

Enforce Kubernetes RBAC, NetworkPolicy, and pod security standards.

Community
Advanced
scumunnascumunna
1

platform-access-and-permissions-governance

Automate access reviews and role assignments across DSPs, ad servers, and analytics tools.

Community
Advanced