iam

Design and review AWS IAM policies for least privilege access.

15|20|Updated May 11, 2026
One-click install
npx skills add https://github.com/awslabs/startups --skill iam-awslabs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: iam
Source: https://github.com/awslabs/startups/tree/main/solution-architecture/plugins/aws-dev-toolkit/skills/iam
Command: npx skills add https://github.com/awslabs/startups --skill iam-awslabs

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams design, audit, and troubleshoot AWS IAM configurations while avoiding excessive permissions, insecure access patterns, and privilege escalation risks.

Core Features & Use Cases

  • IAM Policy Design: Create and review identity policies, resource-based policies, permission boundaries, and service control policies using least privilege principles.
  • Access Management Guidance: Configure IAM roles, Identity Center access, cross-account access, and workload authentication patterns for AWS environments.
  • Security Reviews: Analyze permission issues, validate policies, and apply Access Analyzer recommendations for production-ready AWS security.
  • Use Case: A cloud engineering team can use this Skill to review an application's IAM role, identify overly broad permissions, and create a restricted policy aligned with actual workload needs.

Quick Start

Ask the iam skill to review this AWS IAM policy and recommend least-privilege improvements.

Frequently Asked Questions about iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review an AWS IAM policy for least privilege permissions?

To review AWS IAM policies for least privilege, analyze existing identity and resource-based policies to identify overly broad permissions and generate restricted policies aligned with actual workload needs. This process validates permissions and highlights security risks.

What is the best way to design AWS IAM roles for cross-account access?

Designing AWS IAM roles for cross-account access requires configuring secure role trust policies and permission boundaries to enforce least privilege. This approach ensures workloads authenticate securely across accounts without exposing resources to privilege escalation risks.

How do I implement service control policies and permission boundaries in AWS IAM?

Implementing service control policies and permission boundaries involves creating layered AWS IAM configurations that restrict maximum allowable permissions. This mechanism enforces secure access control and prevents privilege escalation across your AWS organizational units.

Can I use this to troubleshoot AWS IAM permission issues and apply Access Analyzer recommendations?

Yes, you can troubleshoot AWS IAM permission issues by analyzing access problems and applying Access Analyzer recommendations. This validates your policies, identifies security risks, and produces compliant access patterns for production-ready environments.

Does this approach work for configuring AWS Identity Center access and workload authentication?

Yes, this approach works for configuring AWS Identity Center access and workload authentication patterns. It provides guidance on setting up secure access management for AWS environments, ensuring identities and workloads authenticate with least privilege permissions.