review-access

Automate quarterly AWS IAM access reviews and generate flagged-user reports.

7|2|Updated Apr 3, 2026
One-click install
npx skills add https://github.com/kkmookhey/shasta --skill review-access
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review-access
Source: https://github.com/kkmookhey/shasta/tree/main/.claude/skills/review-access
Command: npx skills add https://github.com/kkmookhey/shasta --skill review-access

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Automates quarterly IAM access reviews to ensure SOC 2 compliance by identifying risky users, reviewing permissions and activity, and flagging issues for remediation.

Core Features & Use Cases

  • Automated Review: Enumerates users, permissions, MFA status, and console activity to produce a defensible audit.
  • Flagging & Reporting: Highlights risky configurations and generates an audit-ready report for evidence.
  • Use Case: SOC 2 controls CC6.2/CC6.3 require periodic access reviews and traceable artifacts.

Quick Start

Initiate the access review using the configured Python environment to generate and save the audit report.

Frequently Asked Questions about review-access

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate quarterly IAM access reviews for AWS to ensure SOC 2 compliance?

Automated IAM access reviews enumerate AWS users, permissions, MFA status, and console activity to produce an audit-ready report with flagged non-compliant users and remediation recommendations for SOC 2 controls CC6.2 and CC6.3.

What do I need to configure before running an automated AWS access review?

Running an AWS access review requires valid AWS credentials and a configured shasta.config.json file specifying the python_cmd to execute the run_access_review and save_access_review workflow.

What specific user risks are flagged during an AWS IAM access review?

An AWS IAM access review flags risky configurations by enumerating user permissions, verifying MFA status, and analyzing console activity to identify non-compliant users requiring remediation.

What's the best way to generate an audit-ready report for SOC 2 access reviews?

Generating an audit-ready SOC 2 report involves running an automated Python workflow that enumerates IAM users, evaluates permissions and MFA status, and outputs a defensible artifact with flagged issues and remediation recommendations.

Can I use automated access reviews to identify inactive AWS IAM users?

Automated access reviews evaluate console activity alongside permissions and MFA status to identify risky and non-compliant users, producing a report that flags these accounts for remediation.

Does the IAM access review workflow output a report I can use as SOC 2 evidence?

The IAM access review workflow outputs a defensible audit report containing flagged users and remediation recommendations, serving as traceable artifacts for SOC 2 controls CC6.2 and CC6.3.