skills.rest
engineers-hub-ltd-in-house-project
engineers-hub-ltd-in-house-projectOFFICIAL
Explore all skills by this author →
GitHub

iam-security

Designs secure AWS IAM policies and configures roles with least privilege principles.

Updated Feb 26, 2026
Search Tags:#security#aws#iam#policy#role#least-privilege#aws-infrastructure
One-click install
npx skills add https://github.com/engineers-hub-ltd-in-house-project/eh-skills --skill iam-security
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iam-security
Source: https://github.com/engineers-hub-ltd-in-house-project/eh-skills/tree/main/skills/aws-infrastructure/iam-security
Command: npx skills add https://github.com/engineers-hub-ltd-in-house-project/eh-skills --skill iam-security

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical need for robust security in AWS by providing best practices and patterns for designing and implementing secure Identity and Access Management (IAM) policies and roles.

Core Features & Use Cases

  • Least Privilege Policies: Design IAM policies that grant only the minimum necessary permissions.
  • Role Configuration: Set up IAM roles for services (like ECS tasks) and cross-account access.
  • Advanced Controls: Implement conditional access, permissions boundaries, and OIDC for CI/CD.
  • Use Case: When setting up a new microservice on AWS ECS, use this Skill to define a secure IAM task role that can only access specific S3 buckets and Secrets Manager secrets required by the service.

Quick Start

Use the iam-security skill to generate a least-privilege IAM policy for an ECS task role that needs to read from a specific S3 bucket and retrieve secrets from Secrets Manager.

Frequently Asked Questions about iam-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a least-privilege IAM policy for an ECS task role?▼

To create a least-privilege IAM policy for an ECS task role, grant only the minimum permissions required for the service to access specific resources like S3 buckets and Secrets Manager secrets. This limits potential blast radius.

What are the best practices for configuring cross-account access in AWS IAM?▼

Best practices for cross-account access in AWS IAM involve using IAM roles with strict trust policies, implementing permissions boundaries, and applying conditional keys to restrict access securely across different AWS environments.

How do conditional keys work in AWS IAM policies?▼

Conditional keys in AWS IAM policies work by enforcing context-aware access controls. They evaluate request conditions such as source IP or secure transport, ensuring permissions are granted only under specific security criteria.

When should I use permissions boundaries instead of standard IAM roles?▼

Use permissions boundaries when delegating administrative tasks to others, ensuring they cannot exceed the maximum allowed permissions. This advanced control works alongside standard IAM roles to cap privilege escalation in secure AWS environments.

Can I use OIDC for CI/CD pipelines to access AWS resources securely?▼

Yes, you can implement OIDC for CI/CD pipelines to access AWS resources securely. This avoids long-lived credentials by using identity federation to grant temporary least-privilege access directly to your deployment workflows.

Related Skills

Explore More Software Engineering Skills→
truongnattruongnat

aws-pro

Manage AWS infrastructure with Terraform or AWS CDK.

Community
Advanced
balsm-healthbalsm-health
2

securing-aws-lambda-execution-roles

Secure AWS Lambda execution roles with least-privilege IAM policies and permission boundaries.

Official
Advanced
mattwyskielmattwyskiel
1

aws-iam

Generate AWS IAM policies and manage roles for Lambda, Glue, and CloudTrail.

Community
Advanced
david-2814david-2814
3

secrets-manager

Manage AWS Secrets Manager secrets, rotation, versioning, and cross-account sharing via AWS CLI.

Community
Advanced