skills.rest
subimagesec
subimagesecOFFICIAL
Explore all skills by this author →
Website𝕏@subimagesecGitHub

investigate-iam

Audit AWS IAM privilege exposure via Cypher graph queries.

Updated Apr 30, 2026
Search Tags:#aws#iam#cypher#subimage#trust-chains#privilege-audit#identity-center
One-click install
npx skills add https://github.com/subimagesec/skills --skill investigate-iam
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: investigate-iam
Source: https://github.com/subimagesec/skills/tree/main/plugins/subimage-mcp/skills/investigate-iam
Command: npx skills add https://github.com/subimagesec/skills --skill investigate-iam

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It turns a manual IAM security review into a single structured investigation, helping you find who has effective admin access, how roles and accounts trust each other, and what Identity Center permission sets actually grant.

Core Features & Use Cases

  • Admin-equivalent discovery: Finds direct admins, indirect admins through assume-role paths, and group-based admin access.
  • Trust-chain analysis: Maps cross-account trust relationships, multi-hop role chaining, and identity provider to AWS role mappings.
  • PermissionSet review: Expands Identity Center permission sets into the roles and policies they provision, including admin-equivalent grants.
  • Use case: Use it during an access review, incident response, or privilege escalation investigation to produce a clear IAM risk summary from the SubImage graph.

Quick Start

Ask the assistant to audit IAM privilege for the target AWS account or role and return the direct admins, trust chains, PermissionSet grants, and risk summary.

Frequently Asked Questions about investigate-iam

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find admin-equivalent IAM roles and privilege escalation paths in AWS?▼

Map cross-account trust chains and multi-hop role chaining by querying the SubImage graph with Cypher to visualize identity provider to AWS role mappings and report trust relationships across accounts.

How do I expand AWS Identity Center PermissionSets to review effective permissions?▼

Expand Identity Center PermissionSets by auditing them to reveal the specific roles and policies they provision, including admin-equivalent grants, to produce a clear IAM risk summary for access reviews.

What is the best way to automate an AWS IAM access review for incident response?▼

Yes, AWS IAM privilege auditing works with cross-account trust relationships by mapping multi-hop role chaining and identity provider to AWS role mappings to visualize how roles and accounts trust each other.

Do I need Cypher graph queries to audit AWS IAM privilege exposure?▼

Yes, auditing AWS IAM privilege exposure requires Cypher graph queries and schema validation against the SubImage graph to accurately trace effective permissions and identify admin-equivalent identities.

Related Skills

Explore More Data & Analytics Skills→
pypeadaypypeaday
2

aws-iam

Automate creation and validation of least-privilege AWS IAM policies.

Community
Advanced
ivanshamaevivanshamaev
14

infra-rbac-audit

Audit Kubernetes RBAC, AWS IAM, GCP IAM, database, and Airflow permissions for excessive access.

Community
Advanced
YukiIto1999YukiIto1999

detecting-aws-cloudtrail-anomalies

Detect anomalous AWS CloudTrail API activity and output a JSON report.

Community
Advanced
balsm-healthbalsm-health
2

securing-aws-lambda-execution-roles

Secure AWS Lambda execution roles with least-privilege IAM policies and permission boundaries.

Official
Advanced