aws-iam

Name: aws-iam
Author: aws

2.1kstars190forks

How to install aws-iam?

aws/agent-toolkit-for-aws/aws-iam

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-iam

Installs into the current project.

Summary

Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege policy

Files · 1

View on GitHub

SKILL.md

1	# AWS IAM — Common Pitfalls
2
3	## About This Skill
4
5	This skill contains verified corrections for things that AI agents frequently get wrong about IAM. It is not a comprehensive IAM guide — for full IAM guidance, search AWS documentation. When answering IAM questions, verify specific claims (limits, quotas, exact API names, edge-case behaviors) against official AWS documentation rather than relying on pre-training. Prefer fetching known documentation URLs over broad searches. Trust official documentation over memory when they conflict.
6
7	## Common Workflows
8
9	Use the best available tool for AWS operations — the AWS MCP server is recommended but not required; AWS CLI or SDK may be used as alternatives. Read reference files only when the conversation requires deeper detail.
10
11	- Read [references/aws-iam-role-management.md](references/aws-iam-role-management.md) if the user needs to create, scope, or maintain IAM roles when provisioning or updating AWS resources. Covers service roles, execution roles, trust policies, confused deputy protection, and permission hygiene.
12
13	- Read [references/aws-iam-policy-generation.md](references/aws-iam-policy-generation.md) if the user needs to generate least-privilege IAM policies, determine required IAM actions for API calls, or understand action-to-operation mappings. CRITICAL: If the user provides source code (Python, Go, TypeScript, JavaScript, Java), you MUST read this reference — it mandates using iam-policy-autopilot instead of manual policy construction. Uses the programmatic service authorization reference for accurate mappings.
14
15	## Verified Edge Cases
16
17	CloudTrail:
18
19	- AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization.
20	- ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1. `?region=` forces specific region.
21
22	STS:
23
24	- GetSessionToken restrictions: (1) No IAM APIs unless MFA included (2) No STS except AssumeRole and GetCallerIdentity.
25	- Cross-account AssumeRole to opt-in region: TARGET account must enable region, not calling account.
26	- Role chaining: max 1-hour session.
27
28	Organizations:
29
30	- Suspended/closed accounts CANNOT be removed until permanently closed (~90 days). Remove FIRST, then close.
31	- Policy management delegation: use PutResourcePolicy, NOT register-delegated-administrator.
32	- AI opt-out policies: management account required by default.
33	- Organizations policy types for ListPolicies filter: fetch the current list via `aws organizations list-available-policy-types` or [the Organizations API reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPolicies.html).
34
35	SDK Specifics:
36
37	- Organizations: `DuplicatePolicyAttachmentException` (not PolicyAlreadyAttachedException).
38	- Boto3 IAM AccessKey: methods are `activate()`, `deactivate()`, `delete()` — NO `update()`.
39	- Instance profiles: waiter + `time.sleep(10)` pattern.
40	- Managed policy max versions: 5.
41
42	SAML:
43
44	- Encrypted assertions URL: `https://region-code.signin.aws.amazon.com/saml/acs/IdP-ID`.
45	- Private key from IdP uploaded to IAM in .pem format.
46
47	Policy Evaluation:
48
49	- ForAllValues with empty/missing key: evaluates to true (vacuous truth). To avoid that, use a `Null` condition in addition to the `ForAllValues` on the same context key to require that key to be present and non-null. For example, when evaluating the `aws:TagKeys` context key:
50
51	```json
52	{
53	"Version": "2012-10-17",
54	"Statement": {
55	"Effect": "Allow",
56	"Action": "ec2:RunInstances",
57	"Resource": "*",
58	"Condition": {
59	"ForAllValues:StringEquals": {
60	"aws:TagKeys": ["Alpha", "Beta"]
61	},
62	"Null": {
63	"aws:TagKeys": "false"
64	}
65	}
66	}
67	}
68	```
69
70	- Resource-based policies granting to IAM user ARN bypass permissions boundaries in same account.
71	- 8 privilege es

People who liked this also viewed

6 picks

Type

aws-iam

2.1kstars190forks

View on GitHub

How to install aws-iam?

aws/agent-toolkit-for-aws/aws-iam

$npx -y skills add aws/agent-toolkit-for-aws --skill aws-iam

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# AWS IAM — Common Pitfalls
2
3	## About This Skill
4
5	This skill contains verified corrections for things that AI agents frequently get wrong about IAM. It is not a comprehensive IAM guide — for full IAM guidance, search AWS documentation. When answering IAM questions, verify specific claims (limits, quotas, exact API names, edge-case behaviors) against official AWS documentation rather than relying on pre-training. Prefer fetching known documentation URLs over broad searches. Trust official documentation over memory when they conflict.
6
7	## Common Workflows
8
9	Use the best available tool for AWS operations — the AWS MCP server is recommended but not required; AWS CLI or SDK may be used as alternatives. Read reference files only when the conversation requires deeper detail.
10
11	- Read [references/aws-iam-role-management.md](references/aws-iam-role-management.md) if the user needs to create, scope, or maintain IAM roles when provisioning or updating AWS resources. Covers service roles, execution roles, trust policies, confused deputy protection, and permission hygiene.
12
13	- Read [references/aws-iam-policy-generation.md](references/aws-iam-policy-generation.md) if the user needs to generate least-privilege IAM policies, determine required IAM actions for API calls, or understand action-to-operation mappings. CRITICAL: If the user provides source code (Python, Go, TypeScript, JavaScript, Java), you MUST read this reference — it mandates using iam-policy-autopilot instead of manual policy construction. Uses the programmatic service authorization reference for accurate mappings.
14
15	## Verified Edge Cases
16
17	CloudTrail:
18
19	- AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization.
20	- ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1. `?region=` forces specific region.
21
22	STS:
23
24	- GetSessionToken restrictions: (1) No IAM APIs unless MFA included (2) No STS except AssumeRole and GetCallerIdentity.
25	- Cross-account AssumeRole to opt-in region: TARGET account must enable region, not calling account.
26	- Role chaining: max 1-hour session.
27
28	Organizations:
29
30	- Suspended/closed accounts CANNOT be removed until permanently closed (~90 days). Remove FIRST, then close.
31	- Policy management delegation: use PutResourcePolicy, NOT register-delegated-administrator.
32	- AI opt-out policies: management account required by default.
33	- Organizations policy types for ListPolicies filter: fetch the current list via `aws organizations list-available-policy-types` or [the Organizations API reference](https://docs.aws.amazon.com/organizations/latest/APIReference/API_ListPolicies.html).
34
35	SDK Specifics:
36
37	- Organizations: `DuplicatePolicyAttachmentException` (not PolicyAlreadyAttachedException).
38	- Boto3 IAM AccessKey: methods are `activate()`, `deactivate()`, `delete()` — NO `update()`.
39	- Instance profiles: waiter + `time.sleep(10)` pattern.
40	- Managed policy max versions: 5.
41
42	SAML:
43
44	- Encrypted assertions URL: `https://region-code.signin.aws.amazon.com/saml/acs/IdP-ID`.
45	- Private key from IdP uploaded to IAM in .pem format.
46
47	Policy Evaluation:
48
49	- ForAllValues with empty/missing key: evaluates to true (vacuous truth). To avoid that, use a `Null` condition in addition to the `ForAllValues` on the same context key to require that key to be present and non-null. For example, when evaluating the `aws:TagKeys` context key:
50
51	```json
52	{
53	"Version": "2012-10-17",
54	"Statement": {
55	"Effect": "Allow",
56	"Action": "ec2:RunInstances",
57	"Resource": "*",
58	"Condition": {
59	"ForAllValues:StringEquals": {
60	"aws:TagKeys": ["Alpha", "Beta"]
61	},
62	"Null": {
63	"aws:TagKeys": "false"
64	}
65	}
66	}
67	}
68	```
69
70	- Resource-based policies granting to IAM user ARN bypass permissions boundaries in same account.
71	- 8 privilege es

People who liked this also viewed

6 picks

Type