aws-iam

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

Quality

84%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A dense, highly actionable reference catalog of verified IAM edge cases with concrete values and a useful JSON example. Weaknesses are the inlined edge-case content that overlaps an existing reference file and the absence of explicit validation loops in the destructive role/policy-creation workflows.

Suggestions

Add an explicit validation/verification checkpoint to the role-management and policy-generation workflows (e.g., 'After creating a role, validate the trust policy with aws iam get-role and simulate access with iam:simulate-principal-policy before declaring success') to support a validate→fix→retry loop for these destructive operations.

Move or deduplicate the inlined 'Verified Edge Cases' catalog against references/common-pitfalls.md — either link to it with a brief summary in the body, or remove the overlapping reference file, so the body stays a lean overview.

Link the two orphaned bundle files (common-pitfalls.md, service-authorization.md) from the body with explicit 'Read X if...' triggers so all references are discoverable.

Dimension	Reasoning	Score
Conciseness	The body is dense and assumes Claude's competence — terse bullets like 'Boto3 IAM AccessKey: methods are activate(), deactivate(), delete() — NO update()' earn their place — but a sizable 'Verified Edge Cases' section is inlined while a common-pitfalls.md reference already exists, so some content could be trimmed/relocated.	4 / 5
Actionability	Highly concrete throughout: exact method names, specific exception names ('DuplicatePolicyAttachmentException (not PolicyAlreadyAttachedException)'), a complete copy-paste JSON policy demonstrating the ForAllValues+Null pattern, and precise trust-principal pairs ('redshift-serverless.amazonaws.com AND redshift.amazonaws.com').	5 / 5
Workflow Clarity	Clear routing to reference workflows with explicit triggers ('Read references/aws-iam-policy-generation.md if the user needs to generate IAM policies...') and a documentation-verification directive, but the operational workflows (role/policy creation) involve destructive privilege-escalation-prone changes without explicit validate→fix→retry checkpoints in the body, capping the score per the destructive-operations guidance.	3 / 5
Progressive Disclosure	Good structure with well-signaled one-level-deep references to aws-iam-role-management.md and aws-iam-policy-generation.md, but two bundle files (common-pitfalls.md, service-authorization.md) are not linked from the body and the inlined edge-case catalog overlaps common-pitfalls.md — minor organization gaps.	4 / 5
	Total	16 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A high-quality description: third-person voice, concrete capabilities, explicit trigger conditions, and a clear scope boundary. The only minor gap is a few missing natural synonyms in the trigger terms.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete capabilities — 'verified corrections for IAM behaviors', 'structured workflows for IAM role management', 'baseline policy generation from application source code or a Terraform plan JSON', plus specifics like 'condition operator safety (ForAnyValue/ForAllValues with Null checks)' and 'confused deputy protection' — matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly answers what ('Provides verified corrections...', workflows, policy generation) and when ('Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role') with concrete trigger phrases, plus an explicit non-coverage boundary.	5 / 5
Trigger Term Quality	Good natural-term coverage — 'IAM roles', 'bucket policies', 'Terraform plan JSON', 'STS', 'Organizations', 'condition operators', 'service or execution role' — but a few common synonyms a user might say ('permissions', 'trust relationships', 'AWS permissions') are absent, so it sits just below the comprehensive anchor.	4 / 5
Distinctiveness Conflict Risk	Clear AWS-IAM niche with distinct triggers and an explicit boundary — 'Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC' — minimizing overlap with adjacent skills.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-core/skills/aws-iam/SKILL.md
Commit: 8ea26bd

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.