aws-iam

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: access-control, cloud, compliance, security, validation.

What it does

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill aws-iam

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/plugins/aws-core/skills/aws-iam ~/.claude/skills/aws-iam

Safety box score

Grade F, high risk: 75 of 100 risk points, rated 2026-10-14. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is an IAM policy/role assistant: it reads source code or Terraform plans, queries AWS docs and account metadata, then generates or can upload IAM policies and service roles. The main risks are IAM blast radius, automatic shell/network activity, and possible exposure of local config or credentials during discovery.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	The skill directs the agent to run shell commands such as `uvx iam-policy-autopilot@latest generate-policies`, `curl`, `aws sts get-caller-identity`, `terraform plan`, and `rm -f`, so it does execute external commands even though it ships no native binary.
Network access	2 (moderate)	It fetches remote content from `https://servicereference.us-east-1.amazonaws.com/...`, may invoke `uvx ...@latest`, and suggests `brew`/`pip` installs, all of which require network access.
Filesystem reach	2 (moderate)	It explicitly reads project/config files like `.env`, `terraform.tfvars`, `*.tf`, `cdk.json`, and `serverless.yml`, and it deletes sensitive plan artifacts with `rm -f plan.tfplan plan.json`.
Secrets & credentials	2 (moderate)	Task 1b queries STS and scans `.env`/`terraform.tfvars` to discover account IDs and regions, which can touch credentials or other sensitive local configuration.
Privilege & persistence	2 (moderate)	It tells the user to install `uv` or `iam-policy-autopilot` via `brew`/`pip`, which changes the local user environment and package set.
Instruction hijack surface	3 (high)	The text repeatedly pressures the agent to skip confirmation and proceed automatically, e.g. 'Do not ask for confirmation' / 'proceed directly with role creation' / 'do NOT ask the user for permission to proceed'.
Irreversible actions	3 (high)	Inherent to its purpose, the skill can create and maintain IAM roles and, via `--upload-policies`, create and attach IAM policies directly, which can change account authorization and privileges.
Transparency	2 (moderate)	It relies on external, unpinned behavior such as `uvx iam-policy-autopilot@latest` and remote service-reference JSON, so reviewers cannot inspect the full code path in-repo.

Before installing

Read `references/aws-iam-policy-generation.md` and decide whether you accept it reading `.env`/`terraform.tfvars` and querying STS for discovery.
If you may use policy upload, confirm you want a skill that can create/attach IAM policies and review the generated policy with IAM simulation first.
Run it first in a scratch AWS account or with least-privilege credentials so any IAM changes are contained.
If you do not want external package execution, avoid the `uvx iam-policy-autopilot@latest` path and inspect the fallback/reference behavior instead.

Rated 2026-10-14 by an automated review of 5 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: plugins/aws-core/skills/aws-iam/SKILL.md
Branch: main
Collection: aws-core
Updated: 2026-09-19

agents-harden — Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session lifecycle.
aws-cloudformation — Authors, validates, and troubleshoots AWS CloudFormation templates.
aws-secrets-manager — Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords.
aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
agents-pay — Use when THIS agent needs to pay for x402-protected content at runtime: hitting a paywall mid-task, settling it via AgentCore Payments.
pentesting-with-aws-security-agent — Run an AWS Security Agent penetration test against a live web application — registers and verifies the target domain.