aws-iam

Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege policy generation. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks for absent keys), bucket policy deny patterns (VPC endpoint restrictions, org path conditions), resource-based policy confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, VPC Flow Logs, Firehose, DataSync, S3 replication, Lambda, Step Functions, ECS, etc.) including trust policies with aws:SourceAccount/aws:SourceArn conditions. Applies when creating or configuring IAM roles, writing IAM or bucket policies, working with STS, Organizations, condition operators, or any task requiring an IAM service role or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

80%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is lean and highly actionable, with well-organized one-level-deep references for deep detail. Its weaknesses are workflow clarity (flat bullet lists without validation checkpoints) and incomplete link coverage of the bundle files.

Suggestions

Link the two orphaned references (common-pitfalls.md, service-authorization.md) from the Common Workflows or Verified Edge Cases section so all bundle files are discoverable from the body.

For the most error-prone procedures (e.g. confused-deputy role creation, least-privilege policy generation), add a short numbered sequence with explicit validation checkpoints rather than leaving them as flat bullets.

Where a workflow involves a destructive or batch-style IAM change, include an explicit validate-then-proceed step to raise workflow clarity.

Dimension	Reasoning	Score
Conciseness	Dense, terse bullets that assume Claude's competence — exact exception names, method lists, and a focused JSON policy example with no PDF-style introductory padding or explanation of basics Claude already knows.	3 / 3
Actionability	Provides copy-paste-ready specifics: exact exception strings ('DuplicatePolicyAttachmentException'), method names ('activate()', 'deactivate()', 'delete()'), named trust principals, and a complete executable Null/ForAllValues JSON policy, fully actionable rather than descriptive.	3 / 3
Workflow Clarity	The 'Common Workflows' section signals when to load each reference and mandates the policy-autopilot reference for source code, but most edge-case content is a flat bullet list without sequenced steps or explicit validate-fix-retry checkpoints.	2 / 3
Progressive Disclosure	The body is a clean overview with well-signaled, one-level-deep markdown links to two reference files, but two of the four bundle files (common-pitfalls.md, service-authorization.md) are not linked from the body, leaving some navigation gaps.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is specific, well-triggered, complete, and clearly scoped to IAM — a strong, low-conflict skill description. It names concrete actions, includes natural trigger terms, and states both what and when explicitly.

Dimension	Reasoning	Score
Specificity	Lists many concrete actions — 'policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics' plus 'role management and least-privilege policy generation' — matching the 'Lists multiple specific concrete actions' anchor.	3 / 3
Completeness	Explicitly answers both what it does ('Verified corrections...', 'structured workflows') and when to use it ('Applies when...'), plus an explicit scope-out ('Does not cover non-IAM authorization...'), matching the clear what-and-when anchor.	3 / 3
Trigger Term Quality	Includes natural trigger phrases users would say — 'creating or configuring IAM roles, writing IAM or bucket policies, working with STS, Organizations, condition operators' — giving good coverage of common phrasings.	3 / 3
Distinctiveness Conflict Risk	The IAM niche is highly specific with distinct triggers and an explicit exclusion of non-IAM authorization (Cognito/RBAC), making conflict with other skills unlikely.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aws/agent-toolkit-for-aws
Path: plugins/aws-core/skills/aws-iam/SKILL.md
Commit: 222ce56

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.