[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-aws-labs-iam":3,"mdc--2u8qr8-key":34,"related-repo-aws-labs-iam":2024,"related-org-aws-labs-iam":2122},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"iam","design and review AWS IAM configurations","Design and review AWS IAM configurations. Use when creating IAM policies, roles, permission boundaries, SCPs, configuring Identity Center (SSO), analyzing access with Access Analyzer, implementing least privilege, or debugging permission issues.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"aws-labs","AWS Labs","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Faws-labs.png","awslabs",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Permissions","permissions",{"name":21,"slug":22,"type":16},"AWS","aws",14,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups","2026-07-12T08:40:34.922261",null,15,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official AWS Startups repository that hosts plugins, skills, tools and resources to support startup builders on AWS","https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fstartups\u002Ftree\u002FHEAD\u002Fsolution-architecture\u002Fplugins\u002Faws-dev-toolkit\u002Fskills\u002Fiam","---\nname: iam\ndescription: Design and review AWS IAM configurations. Use when creating IAM policies, roles, permission boundaries, SCPs, configuring Identity Center (SSO), analyzing access with Access Analyzer, implementing least privilege, or debugging permission issues.\nallowed-tools: Read, Grep, Glob, Bash(aws *), mcp__plugin_aws-dev-toolkit_awsknowledge__*\n---\n\nYou are an AWS IAM specialist. Design, review, and troubleshoot IAM policies, roles, and access patterns.\n\n## Policy Evaluation Logic\n\nAWS evaluates policies in this order:\n\n1. **Explicit Deny** — if any policy says Deny, it's denied. Full stop.\n2. **SCPs** — Organization-level guardrails. Must Allow (implicit deny by default if SCP exists).\n3. **Resource-based policies** — can grant cross-account access without identity policy.\n4. **Permission boundaries** — ceiling on identity-based permissions.\n5. **Session policies** — for assumed roles \u002F federated sessions.\n6. **Identity-based policies** — the attached policies on the user\u002Frole.\n\nThe effective permission is the **intersection** of all applicable policy types (except resource-based policies, which can be additive for same-account access).\n\n## Identity-Based vs Resource-Based Policies\n\n| Feature       | Identity-Based                         | Resource-Based                                                       |\n| ------------- | -------------------------------------- | -------------------------------------------------------------------- |\n| Attached to   | IAM user, group, or role               | AWS resource (S3, SQS, KMS, etc.)                                    |\n| Principal     | Implicit (the entity it's attached to) | Must specify Principal                                               |\n| Cross-account | Requires both sides to allow           | Can grant access alone (no identity policy needed on the other side) |\n| Use when      | Defining what an entity can do         | Defining who can access a resource                                   |\n\n**Key insight**: For cross-account access, a resource-based policy alone can grant access without any identity policy on the caller's side. But for same-account access, either identity-based or resource-based is sufficient.\n\n## Roles\n\n### When to Use Roles\n\n- **Always**. IAM users with long-lived credentials are an anti-pattern for workloads.\n- EC2: Instance profiles\n- Lambda: Execution roles\n- ECS: Task roles (not task execution roles — those are for pulling images)\n- Cross-account: AssumeRole with external ID\n- Human access: Identity Center (SSO) or federated roles\n\n### Trust Policies\n\nEvery role has a trust policy that defines **who can assume it**. See `references\u002Fpolicy-patterns.md` for trust policy examples (Lambda, EC2, ECS, cross-account, SAML, GitHub Actions OIDC).\n\n**Opinionated guidance:**\n\n- Always specify the most restrictive principal possible\n- For cross-account: use `sts:ExternalId` condition to prevent confused deputy\n- For federated: use `sts:RoleSessionName` condition for auditability\n- Never use `\"Principal\": \"*\"` in a trust policy without conditions\n\n### Session Duration\n\n- Default: 1 hour\n- Max: 12 hours (configurable per role)\n- STS tokens cannot be revoked — keep session duration short\n\n## Least Privilege Patterns\n\n### Start Broad, Then Narrow\n\n1. Start with AWS managed policies (e.g., `ReadOnlyAccess`) during development\n2. Use Access Analyzer to generate a policy based on actual CloudTrail activity\n3. Replace the managed policy with the generated one\n4. Review and tighten further\n\n### Policy Structure for Least Privilege\n\nScope each statement to specific actions, resources (by ARN), and conditions. Separate read and write into distinct statements. See `references\u002Fpolicy-patterns.md` for a full least-privilege S3 example.\n\n**Rules:**\n\n- Never use `\"Action\": \"*\"` or `\"Resource\": \"*\"` without conditions in production\n- Scope resources to the specific ARN, not `*`\n- Use conditions: `aws:RequestedRegion`, `aws:PrincipalOrgID`, `aws:SourceVpc`\n- Separate read and write permissions into different statements for clarity\n\n## Permission Boundaries\n\nPermission boundaries set a **ceiling** on what an identity-based policy can grant. The effective permission is the intersection.\n\n**Use cases:**\n\n- Delegating IAM admin: Allow developers to create roles, but only up to the boundary\n- Limiting scope of auto-created roles (e.g., CDK bootstrap roles)\n\nA typical boundary allows all actions then explicitly denies escalation paths (user creation, access key creation, organizations, account management). See `references\u002Fpolicy-patterns.md` for the full JSON example.\n\n**Key**: A permission boundary Deny is absolute -- it cannot be overridden by identity policies.\n\n## Service Control Policies (SCPs)\n\nSCPs are guardrails for an AWS Organization. They restrict what **member accounts** can do (not the management account).\n\n### Common SCP Patterns\n\nCommon SCP deny statements: region restriction, deny leaving org, require IMDSv2, deny public RDS, deny unencrypted EBS, deny root access keys. See `references\u002Fpolicy-patterns.md` for individual JSON examples of each.\n\n**SCP principles:**\n\n- SCPs are deny-only in practice. Start with `FullAWSAccess` and add deny statements.\n- Always exempt a break-glass admin role from SCP denies (via condition)\n- SCPs do not affect the management account — use it only for billing and org management\n- SCPs do not affect service-linked roles\n\n## Identity Center (SSO)\n\nIdentity Center is the recommended way for humans to access AWS accounts.\n\n### Architecture\n\n- **Identity source**: Identity Center directory, Active Directory, or external IdP (Okta, Azure AD)\n- **Permission sets**: Define what users can do in an account (maps to an IAM role)\n- **Account assignments**: Connect groups\u002Fusers to accounts with a permission set\n\n### Best Practices\n\n- Use groups, never assign users directly\n- Create permission sets that match job functions: `AdminAccess`, `DeveloperAccess`, `ReadOnlyAccess`\n- Use managed policies in permission sets when possible, custom inline for fine-grained control\n- Session duration: 4-8 hours for developers, 1 hour for admin access\n- Require MFA for all users (enforce at Identity Center level)\n\n## Access Analyzer\n\n### Policy Generation\n\n- Access Analyzer reviews CloudTrail logs and generates a least-privilege policy based on actual usage\n- Requires CloudTrail enabled with management events (at minimum)\n- Generation period: 1-90 days of CloudTrail data. Use at least 30 days for production roles.\n\n### External Access Findings\n\n- Detects resources shared with external principals (other accounts, public access)\n- Analyzers: account-level or organization-level\n- Resource types: S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, Secrets Manager\n- Review findings regularly — archive expected cross-account sharing, remediate unexpected\n\n### Policy Validation\n\n- Validates IAM policies against best practices\n- Integrates into CI\u002FCD to catch policy issues before deployment\n- Checks for: overly permissive actions, missing resource constraints, syntax errors\n\n## Cross-Account Access\n\n### Pattern 1: AssumeRole (Preferred)\n\n1. Target account: Create role with trust policy allowing source account\n2. Source account: Grant `sts:AssumeRole` on the target role ARN\n3. Application calls `sts:AssumeRole`, gets temporary credentials\n\nAlways use `sts:ExternalId` condition to prevent confused deputy attacks.\n\n### Pattern 2: Resource-Based Policy\n\n- Attach policy on the resource (S3, SQS, KMS) granting access to the external principal\n- Simpler but less flexible — not all services support resource-based policies\n- Caller does not need to assume a role\n\n### Pattern 3: AWS Organizations\n\n- Use `aws:PrincipalOrgID` condition to allow access from any account in the organization\n- Cleaner than listing individual account IDs\n\n## Common CLI Commands\n\n```bash\n# List roles\naws iam list-roles --query 'Roles[*].{Name:RoleName,Arn:Arn}' --output table\n\n# Get role's attached policies\naws iam list-attached-role-policies --role-name my-role\n\n# Get inline policy document\naws iam get-role-policy --role-name my-role --policy-name my-policy\n\n# Simulate policy evaluation\naws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role\u002Fmy-role \\\n  --action-names s3:GetObject --resource-arns arn:aws:s3:::my-bucket\u002F*\n\n# Generate policy from Access Analyzer\naws accessanalyzer start-policy-generation --policy-generation-details '{\"principalArn\":\"arn:aws:iam::123456789012:role\u002Fmy-role\"}'\n\n# List Access Analyzer findings\naws accessanalyzer list-findings --analyzer-arn arn:aws:accessanalyzer:us-east-1:123456789012:analyzer\u002Fmy-analyzer \\\n  --query 'findings[?status==`ACTIVE`]'\n\n# Validate a policy\naws accessanalyzer validate-policy --policy-document file:\u002F\u002Fpolicy.json --policy-type IDENTITY_POLICY\n\n# Get credential report\naws iam generate-credential-report && sleep 5 && aws iam get-credential-report --query Content --output text | base64 -d\n\n# List users with access keys\naws iam list-users --query 'Users[*].UserName' --output text | xargs -I{} aws iam list-access-keys --user-name {}\n\n# Get last accessed services for a role\naws iam generate-service-last-accessed-details --arn arn:aws:iam::123456789012:role\u002Fmy-role\n\n# List Identity Center permission sets\naws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance\u002Fssoins-xxx\n\n# List SCPs\naws organizations list-policies --filter SERVICE_CONTROL_POLICY --query 'Policies[*].{Name:Name,Id:Id}'\n```\n\n## Anti-Patterns\n\n- **IAM users for workloads**: Never create IAM users with access keys for applications. Use IAM roles with temporary credentials via instance profiles, task roles, or AssumeRole.\n- **`\"Action\": \"*\"` on `\"Resource\": \"*\"`**: Overly permissive. Always scope to specific actions and resources. Use Access Analyzer to determine what's actually needed.\n- **Inline policies on users**: Use groups for human access, roles for workloads. Inline policies on individual users are unmaintainable.\n- **Long-lived access keys without rotation**: If you must use access keys (you shouldn't), rotate every 90 days. Better: eliminate them entirely.\n- **Not using permission boundaries for delegated admin**: If developers can create IAM roles, they can escalate privileges. Permission boundaries prevent this.\n- **SCPs that don't exempt a break-glass role**: If you lock something down with SCPs and have no escape hatch, you'll be locked out during incidents.\n- **`iam:PassRole` without resource constraint**: PassRole lets an entity assign a role to a service. Without constraining which roles can be passed, it's a privilege escalation path.\n- **Not using `aws:PrincipalOrgID`**: When granting cross-account access within an org, use this condition instead of listing individual account IDs. Easier to maintain and automatically includes new accounts.\n- **Ignoring Access Analyzer findings**: External access findings tell you what's shared outside your account. Unreviewed findings are unmanaged risk.\n- **MFA not enforced for console access**: All human users must have MFA. Enforce it via Identity Center or with an IAM policy condition `aws:MultiFactorAuthPresent`.\n\n## Reference Files\n\n| File                            | Contents                                                                                                                                                                                                    |\n| ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `references\u002Fpolicy-patterns.md` | Identity-based policies, trust policies (Lambda, EC2, ECS, cross-account, SAML, GitHub Actions OIDC), resource-based policies (S3, KMS, SQS), permission boundaries, SCP examples, condition keys reference |\n| `references\u002Frole-templates.md`  | Persona-based role templates with trust and identity policies: Developer, Data Engineer, On-Call\u002FOperations, CI\u002FCD Pipeline, Read-Only Auditor, plus a shared permission boundary                           |\n\n## Related Skills\n\n- `security-review` -- comprehensive security audit and IaC review\n- `aws-architect` -- well-architected design guidance\n- `networking` -- VPC, subnets, security groups, NACLs\n- `lambda` -- Lambda execution roles and resource policies\n- `ecs` -- ECS task roles vs task execution roles\n- `eks` -- Kubernetes RBAC and IRSA (IAM Roles for Service Accounts)\n",{"data":35,"body":37},{"name":4,"description":6,"allowed-tools":36},"Read, Grep, Glob, Bash(aws *), mcp__plugin_aws-dev-toolkit_awsknowledge__*",{"type":38,"children":39},"root",[40,48,55,60,126,138,144,249,259,265,272,311,317,338,346,393,399,417,423,429,460,466,478,486,551,557,569,577,590,602,612,618,630,636,648,656,687,693,698,704,737,743,790,796,802,820,826,849,855,873,879,885,918,930,936,954,960,980,986,1744,1750,1882,1888,1943,1949,2018],{"type":41,"tag":42,"props":43,"children":44},"element","p",{},[45],{"type":46,"value":47},"text","You are an AWS IAM specialist. Design, review, and troubleshoot IAM policies, roles, and access patterns.",{"type":41,"tag":49,"props":50,"children":52},"h2",{"id":51},"policy-evaluation-logic",[53],{"type":46,"value":54},"Policy Evaluation Logic",{"type":41,"tag":42,"props":56,"children":57},{},[58],{"type":46,"value":59},"AWS evaluates policies in this order:",{"type":41,"tag":61,"props":62,"children":63},"ol",{},[64,76,86,96,106,116],{"type":41,"tag":65,"props":66,"children":67},"li",{},[68,74],{"type":41,"tag":69,"props":70,"children":71},"strong",{},[72],{"type":46,"value":73},"Explicit Deny",{"type":46,"value":75}," — if any policy says Deny, it's denied. Full stop.",{"type":41,"tag":65,"props":77,"children":78},{},[79,84],{"type":41,"tag":69,"props":80,"children":81},{},[82],{"type":46,"value":83},"SCPs",{"type":46,"value":85}," — Organization-level guardrails. Must Allow (implicit deny by default if SCP exists).",{"type":41,"tag":65,"props":87,"children":88},{},[89,94],{"type":41,"tag":69,"props":90,"children":91},{},[92],{"type":46,"value":93},"Resource-based policies",{"type":46,"value":95}," — can grant cross-account access without identity policy.",{"type":41,"tag":65,"props":97,"children":98},{},[99,104],{"type":41,"tag":69,"props":100,"children":101},{},[102],{"type":46,"value":103},"Permission boundaries",{"type":46,"value":105}," — ceiling on identity-based permissions.",{"type":41,"tag":65,"props":107,"children":108},{},[109,114],{"type":41,"tag":69,"props":110,"children":111},{},[112],{"type":46,"value":113},"Session policies",{"type":46,"value":115}," — for assumed roles \u002F federated sessions.",{"type":41,"tag":65,"props":117,"children":118},{},[119,124],{"type":41,"tag":69,"props":120,"children":121},{},[122],{"type":46,"value":123},"Identity-based policies",{"type":46,"value":125}," — the attached policies on the user\u002Frole.",{"type":41,"tag":42,"props":127,"children":128},{},[129,131,136],{"type":46,"value":130},"The effective permission is the ",{"type":41,"tag":69,"props":132,"children":133},{},[134],{"type":46,"value":135},"intersection",{"type":46,"value":137}," of all applicable policy types (except resource-based policies, which can be additive for same-account access).",{"type":41,"tag":49,"props":139,"children":141},{"id":140},"identity-based-vs-resource-based-policies",[142],{"type":46,"value":143},"Identity-Based vs Resource-Based Policies",{"type":41,"tag":145,"props":146,"children":147},"table",{},[148,172],{"type":41,"tag":149,"props":150,"children":151},"thead",{},[152],{"type":41,"tag":153,"props":154,"children":155},"tr",{},[156,162,167],{"type":41,"tag":157,"props":158,"children":159},"th",{},[160],{"type":46,"value":161},"Feature",{"type":41,"tag":157,"props":163,"children":164},{},[165],{"type":46,"value":166},"Identity-Based",{"type":41,"tag":157,"props":168,"children":169},{},[170],{"type":46,"value":171},"Resource-Based",{"type":41,"tag":173,"props":174,"children":175},"tbody",{},[176,195,213,231],{"type":41,"tag":153,"props":177,"children":178},{},[179,185,190],{"type":41,"tag":180,"props":181,"children":182},"td",{},[183],{"type":46,"value":184},"Attached to",{"type":41,"tag":180,"props":186,"children":187},{},[188],{"type":46,"value":189},"IAM user, group, or role",{"type":41,"tag":180,"props":191,"children":192},{},[193],{"type":46,"value":194},"AWS resource (S3, SQS, KMS, etc.)",{"type":41,"tag":153,"props":196,"children":197},{},[198,203,208],{"type":41,"tag":180,"props":199,"children":200},{},[201],{"type":46,"value":202},"Principal",{"type":41,"tag":180,"props":204,"children":205},{},[206],{"type":46,"value":207},"Implicit (the entity it's attached to)",{"type":41,"tag":180,"props":209,"children":210},{},[211],{"type":46,"value":212},"Must specify Principal",{"type":41,"tag":153,"props":214,"children":215},{},[216,221,226],{"type":41,"tag":180,"props":217,"children":218},{},[219],{"type":46,"value":220},"Cross-account",{"type":41,"tag":180,"props":222,"children":223},{},[224],{"type":46,"value":225},"Requires both sides to allow",{"type":41,"tag":180,"props":227,"children":228},{},[229],{"type":46,"value":230},"Can grant access alone (no identity policy needed on the other side)",{"type":41,"tag":153,"props":232,"children":233},{},[234,239,244],{"type":41,"tag":180,"props":235,"children":236},{},[237],{"type":46,"value":238},"Use when",{"type":41,"tag":180,"props":240,"children":241},{},[242],{"type":46,"value":243},"Defining what an entity can do",{"type":41,"tag":180,"props":245,"children":246},{},[247],{"type":46,"value":248},"Defining who can access a resource",{"type":41,"tag":42,"props":250,"children":251},{},[252,257],{"type":41,"tag":69,"props":253,"children":254},{},[255],{"type":46,"value":256},"Key insight",{"type":46,"value":258},": For cross-account access, a resource-based policy alone can grant access without any identity policy on the caller's side. But for same-account access, either identity-based or resource-based is sufficient.",{"type":41,"tag":49,"props":260,"children":262},{"id":261},"roles",[263],{"type":46,"value":264},"Roles",{"type":41,"tag":266,"props":267,"children":269},"h3",{"id":268},"when-to-use-roles",[270],{"type":46,"value":271},"When to Use Roles",{"type":41,"tag":273,"props":274,"children":275},"ul",{},[276,286,291,296,301,306],{"type":41,"tag":65,"props":277,"children":278},{},[279,284],{"type":41,"tag":69,"props":280,"children":281},{},[282],{"type":46,"value":283},"Always",{"type":46,"value":285},". IAM users with long-lived credentials are an anti-pattern for workloads.",{"type":41,"tag":65,"props":287,"children":288},{},[289],{"type":46,"value":290},"EC2: Instance profiles",{"type":41,"tag":65,"props":292,"children":293},{},[294],{"type":46,"value":295},"Lambda: Execution roles",{"type":41,"tag":65,"props":297,"children":298},{},[299],{"type":46,"value":300},"ECS: Task roles (not task execution roles — those are for pulling images)",{"type":41,"tag":65,"props":302,"children":303},{},[304],{"type":46,"value":305},"Cross-account: AssumeRole with external ID",{"type":41,"tag":65,"props":307,"children":308},{},[309],{"type":46,"value":310},"Human access: Identity Center (SSO) or federated roles",{"type":41,"tag":266,"props":312,"children":314},{"id":313},"trust-policies",[315],{"type":46,"value":316},"Trust Policies",{"type":41,"tag":42,"props":318,"children":319},{},[320,322,327,329,336],{"type":46,"value":321},"Every role has a trust policy that defines ",{"type":41,"tag":69,"props":323,"children":324},{},[325],{"type":46,"value":326},"who can assume it",{"type":46,"value":328},". See ",{"type":41,"tag":330,"props":331,"children":333},"code",{"className":332},[],[334],{"type":46,"value":335},"references\u002Fpolicy-patterns.md",{"type":46,"value":337}," for trust policy examples (Lambda, EC2, ECS, cross-account, SAML, GitHub Actions OIDC).",{"type":41,"tag":42,"props":339,"children":340},{},[341],{"type":41,"tag":69,"props":342,"children":343},{},[344],{"type":46,"value":345},"Opinionated guidance:",{"type":41,"tag":273,"props":347,"children":348},{},[349,354,367,380],{"type":41,"tag":65,"props":350,"children":351},{},[352],{"type":46,"value":353},"Always specify the most restrictive principal possible",{"type":41,"tag":65,"props":355,"children":356},{},[357,359,365],{"type":46,"value":358},"For cross-account: use ",{"type":41,"tag":330,"props":360,"children":362},{"className":361},[],[363],{"type":46,"value":364},"sts:ExternalId",{"type":46,"value":366}," condition to prevent confused deputy",{"type":41,"tag":65,"props":368,"children":369},{},[370,372,378],{"type":46,"value":371},"For federated: use ",{"type":41,"tag":330,"props":373,"children":375},{"className":374},[],[376],{"type":46,"value":377},"sts:RoleSessionName",{"type":46,"value":379}," condition for auditability",{"type":41,"tag":65,"props":381,"children":382},{},[383,385,391],{"type":46,"value":384},"Never use ",{"type":41,"tag":330,"props":386,"children":388},{"className":387},[],[389],{"type":46,"value":390},"\"Principal\": \"*\"",{"type":46,"value":392}," in a trust policy without conditions",{"type":41,"tag":266,"props":394,"children":396},{"id":395},"session-duration",[397],{"type":46,"value":398},"Session Duration",{"type":41,"tag":273,"props":400,"children":401},{},[402,407,412],{"type":41,"tag":65,"props":403,"children":404},{},[405],{"type":46,"value":406},"Default: 1 hour",{"type":41,"tag":65,"props":408,"children":409},{},[410],{"type":46,"value":411},"Max: 12 hours (configurable per role)",{"type":41,"tag":65,"props":413,"children":414},{},[415],{"type":46,"value":416},"STS tokens cannot be revoked — keep session duration short",{"type":41,"tag":49,"props":418,"children":420},{"id":419},"least-privilege-patterns",[421],{"type":46,"value":422},"Least Privilege Patterns",{"type":41,"tag":266,"props":424,"children":426},{"id":425},"start-broad-then-narrow",[427],{"type":46,"value":428},"Start Broad, Then Narrow",{"type":41,"tag":61,"props":430,"children":431},{},[432,445,450,455],{"type":41,"tag":65,"props":433,"children":434},{},[435,437,443],{"type":46,"value":436},"Start with AWS managed policies (e.g., ",{"type":41,"tag":330,"props":438,"children":440},{"className":439},[],[441],{"type":46,"value":442},"ReadOnlyAccess",{"type":46,"value":444},") during development",{"type":41,"tag":65,"props":446,"children":447},{},[448],{"type":46,"value":449},"Use Access Analyzer to generate a policy based on actual CloudTrail activity",{"type":41,"tag":65,"props":451,"children":452},{},[453],{"type":46,"value":454},"Replace the managed policy with the generated one",{"type":41,"tag":65,"props":456,"children":457},{},[458],{"type":46,"value":459},"Review and tighten further",{"type":41,"tag":266,"props":461,"children":463},{"id":462},"policy-structure-for-least-privilege",[464],{"type":46,"value":465},"Policy Structure for Least Privilege",{"type":41,"tag":42,"props":467,"children":468},{},[469,471,476],{"type":46,"value":470},"Scope each statement to specific actions, resources (by ARN), and conditions. Separate read and write into distinct statements. See ",{"type":41,"tag":330,"props":472,"children":474},{"className":473},[],[475],{"type":46,"value":335},{"type":46,"value":477}," for a full least-privilege S3 example.",{"type":41,"tag":42,"props":479,"children":480},{},[481],{"type":41,"tag":69,"props":482,"children":483},{},[484],{"type":46,"value":485},"Rules:",{"type":41,"tag":273,"props":487,"children":488},{},[489,509,520,546],{"type":41,"tag":65,"props":490,"children":491},{},[492,493,499,501,507],{"type":46,"value":384},{"type":41,"tag":330,"props":494,"children":496},{"className":495},[],[497],{"type":46,"value":498},"\"Action\": \"*\"",{"type":46,"value":500}," or ",{"type":41,"tag":330,"props":502,"children":504},{"className":503},[],[505],{"type":46,"value":506},"\"Resource\": \"*\"",{"type":46,"value":508}," without conditions in production",{"type":41,"tag":65,"props":510,"children":511},{},[512,514],{"type":46,"value":513},"Scope resources to the specific ARN, not ",{"type":41,"tag":330,"props":515,"children":517},{"className":516},[],[518],{"type":46,"value":519},"*",{"type":41,"tag":65,"props":521,"children":522},{},[523,525,531,533,539,540],{"type":46,"value":524},"Use conditions: ",{"type":41,"tag":330,"props":526,"children":528},{"className":527},[],[529],{"type":46,"value":530},"aws:RequestedRegion",{"type":46,"value":532},", ",{"type":41,"tag":330,"props":534,"children":536},{"className":535},[],[537],{"type":46,"value":538},"aws:PrincipalOrgID",{"type":46,"value":532},{"type":41,"tag":330,"props":541,"children":543},{"className":542},[],[544],{"type":46,"value":545},"aws:SourceVpc",{"type":41,"tag":65,"props":547,"children":548},{},[549],{"type":46,"value":550},"Separate read and write permissions into different statements for clarity",{"type":41,"tag":49,"props":552,"children":554},{"id":553},"permission-boundaries",[555],{"type":46,"value":556},"Permission Boundaries",{"type":41,"tag":42,"props":558,"children":559},{},[560,562,567],{"type":46,"value":561},"Permission boundaries set a ",{"type":41,"tag":69,"props":563,"children":564},{},[565],{"type":46,"value":566},"ceiling",{"type":46,"value":568}," on what an identity-based policy can grant. The effective permission is the intersection.",{"type":41,"tag":42,"props":570,"children":571},{},[572],{"type":41,"tag":69,"props":573,"children":574},{},[575],{"type":46,"value":576},"Use cases:",{"type":41,"tag":273,"props":578,"children":579},{},[580,585],{"type":41,"tag":65,"props":581,"children":582},{},[583],{"type":46,"value":584},"Delegating IAM admin: Allow developers to create roles, but only up to the boundary",{"type":41,"tag":65,"props":586,"children":587},{},[588],{"type":46,"value":589},"Limiting scope of auto-created roles (e.g., CDK bootstrap roles)",{"type":41,"tag":42,"props":591,"children":592},{},[593,595,600],{"type":46,"value":594},"A typical boundary allows all actions then explicitly denies escalation paths (user creation, access key creation, organizations, account management). See ",{"type":41,"tag":330,"props":596,"children":598},{"className":597},[],[599],{"type":46,"value":335},{"type":46,"value":601}," for the full JSON example.",{"type":41,"tag":42,"props":603,"children":604},{},[605,610],{"type":41,"tag":69,"props":606,"children":607},{},[608],{"type":46,"value":609},"Key",{"type":46,"value":611},": A permission boundary Deny is absolute -- it cannot be overridden by identity policies.",{"type":41,"tag":49,"props":613,"children":615},{"id":614},"service-control-policies-scps",[616],{"type":46,"value":617},"Service Control Policies (SCPs)",{"type":41,"tag":42,"props":619,"children":620},{},[621,623,628],{"type":46,"value":622},"SCPs are guardrails for an AWS Organization. They restrict what ",{"type":41,"tag":69,"props":624,"children":625},{},[626],{"type":46,"value":627},"member accounts",{"type":46,"value":629}," can do (not the management account).",{"type":41,"tag":266,"props":631,"children":633},{"id":632},"common-scp-patterns",[634],{"type":46,"value":635},"Common SCP Patterns",{"type":41,"tag":42,"props":637,"children":638},{},[639,641,646],{"type":46,"value":640},"Common SCP deny statements: region restriction, deny leaving org, require IMDSv2, deny public RDS, deny unencrypted EBS, deny root access keys. See ",{"type":41,"tag":330,"props":642,"children":644},{"className":643},[],[645],{"type":46,"value":335},{"type":46,"value":647}," for individual JSON examples of each.",{"type":41,"tag":42,"props":649,"children":650},{},[651],{"type":41,"tag":69,"props":652,"children":653},{},[654],{"type":46,"value":655},"SCP principles:",{"type":41,"tag":273,"props":657,"children":658},{},[659,672,677,682],{"type":41,"tag":65,"props":660,"children":661},{},[662,664,670],{"type":46,"value":663},"SCPs are deny-only in practice. Start with ",{"type":41,"tag":330,"props":665,"children":667},{"className":666},[],[668],{"type":46,"value":669},"FullAWSAccess",{"type":46,"value":671}," and add deny statements.",{"type":41,"tag":65,"props":673,"children":674},{},[675],{"type":46,"value":676},"Always exempt a break-glass admin role from SCP denies (via condition)",{"type":41,"tag":65,"props":678,"children":679},{},[680],{"type":46,"value":681},"SCPs do not affect the management account — use it only for billing and org management",{"type":41,"tag":65,"props":683,"children":684},{},[685],{"type":46,"value":686},"SCPs do not affect service-linked roles",{"type":41,"tag":49,"props":688,"children":690},{"id":689},"identity-center-sso",[691],{"type":46,"value":692},"Identity Center (SSO)",{"type":41,"tag":42,"props":694,"children":695},{},[696],{"type":46,"value":697},"Identity Center is the recommended way for humans to access AWS accounts.",{"type":41,"tag":266,"props":699,"children":701},{"id":700},"architecture",[702],{"type":46,"value":703},"Architecture",{"type":41,"tag":273,"props":705,"children":706},{},[707,717,727],{"type":41,"tag":65,"props":708,"children":709},{},[710,715],{"type":41,"tag":69,"props":711,"children":712},{},[713],{"type":46,"value":714},"Identity source",{"type":46,"value":716},": Identity Center directory, Active Directory, or external IdP (Okta, Azure AD)",{"type":41,"tag":65,"props":718,"children":719},{},[720,725],{"type":41,"tag":69,"props":721,"children":722},{},[723],{"type":46,"value":724},"Permission sets",{"type":46,"value":726},": Define what users can do in an account (maps to an IAM role)",{"type":41,"tag":65,"props":728,"children":729},{},[730,735],{"type":41,"tag":69,"props":731,"children":732},{},[733],{"type":46,"value":734},"Account assignments",{"type":46,"value":736},": Connect groups\u002Fusers to accounts with a permission set",{"type":41,"tag":266,"props":738,"children":740},{"id":739},"best-practices",[741],{"type":46,"value":742},"Best Practices",{"type":41,"tag":273,"props":744,"children":745},{},[746,751,775,780,785],{"type":41,"tag":65,"props":747,"children":748},{},[749],{"type":46,"value":750},"Use groups, never assign users directly",{"type":41,"tag":65,"props":752,"children":753},{},[754,756,762,763,769,770],{"type":46,"value":755},"Create permission sets that match job functions: ",{"type":41,"tag":330,"props":757,"children":759},{"className":758},[],[760],{"type":46,"value":761},"AdminAccess",{"type":46,"value":532},{"type":41,"tag":330,"props":764,"children":766},{"className":765},[],[767],{"type":46,"value":768},"DeveloperAccess",{"type":46,"value":532},{"type":41,"tag":330,"props":771,"children":773},{"className":772},[],[774],{"type":46,"value":442},{"type":41,"tag":65,"props":776,"children":777},{},[778],{"type":46,"value":779},"Use managed policies in permission sets when possible, custom inline for fine-grained control",{"type":41,"tag":65,"props":781,"children":782},{},[783],{"type":46,"value":784},"Session duration: 4-8 hours for developers, 1 hour for admin access",{"type":41,"tag":65,"props":786,"children":787},{},[788],{"type":46,"value":789},"Require MFA for all users (enforce at Identity Center level)",{"type":41,"tag":49,"props":791,"children":793},{"id":792},"access-analyzer",[794],{"type":46,"value":795},"Access Analyzer",{"type":41,"tag":266,"props":797,"children":799},{"id":798},"policy-generation",[800],{"type":46,"value":801},"Policy Generation",{"type":41,"tag":273,"props":803,"children":804},{},[805,810,815],{"type":41,"tag":65,"props":806,"children":807},{},[808],{"type":46,"value":809},"Access Analyzer reviews CloudTrail logs and generates a least-privilege policy based on actual usage",{"type":41,"tag":65,"props":811,"children":812},{},[813],{"type":46,"value":814},"Requires CloudTrail enabled with management events (at minimum)",{"type":41,"tag":65,"props":816,"children":817},{},[818],{"type":46,"value":819},"Generation period: 1-90 days of CloudTrail data. Use at least 30 days for production roles.",{"type":41,"tag":266,"props":821,"children":823},{"id":822},"external-access-findings",[824],{"type":46,"value":825},"External Access Findings",{"type":41,"tag":273,"props":827,"children":828},{},[829,834,839,844],{"type":41,"tag":65,"props":830,"children":831},{},[832],{"type":46,"value":833},"Detects resources shared with external principals (other accounts, public access)",{"type":41,"tag":65,"props":835,"children":836},{},[837],{"type":46,"value":838},"Analyzers: account-level or organization-level",{"type":41,"tag":65,"props":840,"children":841},{},[842],{"type":46,"value":843},"Resource types: S3 buckets, IAM roles, KMS keys, Lambda functions, SQS queues, Secrets Manager",{"type":41,"tag":65,"props":845,"children":846},{},[847],{"type":46,"value":848},"Review findings regularly — archive expected cross-account sharing, remediate unexpected",{"type":41,"tag":266,"props":850,"children":852},{"id":851},"policy-validation",[853],{"type":46,"value":854},"Policy Validation",{"type":41,"tag":273,"props":856,"children":857},{},[858,863,868],{"type":41,"tag":65,"props":859,"children":860},{},[861],{"type":46,"value":862},"Validates IAM policies against best practices",{"type":41,"tag":65,"props":864,"children":865},{},[866],{"type":46,"value":867},"Integrates into CI\u002FCD to catch policy issues before deployment",{"type":41,"tag":65,"props":869,"children":870},{},[871],{"type":46,"value":872},"Checks for: overly permissive actions, missing resource constraints, syntax errors",{"type":41,"tag":49,"props":874,"children":876},{"id":875},"cross-account-access",[877],{"type":46,"value":878},"Cross-Account Access",{"type":41,"tag":266,"props":880,"children":882},{"id":881},"pattern-1-assumerole-preferred",[883],{"type":46,"value":884},"Pattern 1: AssumeRole (Preferred)",{"type":41,"tag":61,"props":886,"children":887},{},[888,893,906],{"type":41,"tag":65,"props":889,"children":890},{},[891],{"type":46,"value":892},"Target account: Create role with trust policy allowing source account",{"type":41,"tag":65,"props":894,"children":895},{},[896,898,904],{"type":46,"value":897},"Source account: Grant ",{"type":41,"tag":330,"props":899,"children":901},{"className":900},[],[902],{"type":46,"value":903},"sts:AssumeRole",{"type":46,"value":905}," on the target role ARN",{"type":41,"tag":65,"props":907,"children":908},{},[909,911,916],{"type":46,"value":910},"Application calls ",{"type":41,"tag":330,"props":912,"children":914},{"className":913},[],[915],{"type":46,"value":903},{"type":46,"value":917},", gets temporary credentials",{"type":41,"tag":42,"props":919,"children":920},{},[921,923,928],{"type":46,"value":922},"Always use ",{"type":41,"tag":330,"props":924,"children":926},{"className":925},[],[927],{"type":46,"value":364},{"type":46,"value":929}," condition to prevent confused deputy attacks.",{"type":41,"tag":266,"props":931,"children":933},{"id":932},"pattern-2-resource-based-policy",[934],{"type":46,"value":935},"Pattern 2: Resource-Based Policy",{"type":41,"tag":273,"props":937,"children":938},{},[939,944,949],{"type":41,"tag":65,"props":940,"children":941},{},[942],{"type":46,"value":943},"Attach policy on the resource (S3, SQS, KMS) granting access to the external principal",{"type":41,"tag":65,"props":945,"children":946},{},[947],{"type":46,"value":948},"Simpler but less flexible — not all services support resource-based policies",{"type":41,"tag":65,"props":950,"children":951},{},[952],{"type":46,"value":953},"Caller does not need to assume a role",{"type":41,"tag":266,"props":955,"children":957},{"id":956},"pattern-3-aws-organizations",[958],{"type":46,"value":959},"Pattern 3: AWS Organizations",{"type":41,"tag":273,"props":961,"children":962},{},[963,975],{"type":41,"tag":65,"props":964,"children":965},{},[966,968,973],{"type":46,"value":967},"Use ",{"type":41,"tag":330,"props":969,"children":971},{"className":970},[],[972],{"type":46,"value":538},{"type":46,"value":974}," condition to allow access from any account in the organization",{"type":41,"tag":65,"props":976,"children":977},{},[978],{"type":46,"value":979},"Cleaner than listing individual account IDs",{"type":41,"tag":49,"props":981,"children":983},{"id":982},"common-cli-commands",[984],{"type":46,"value":985},"Common CLI Commands",{"type":41,"tag":987,"props":988,"children":993},"pre",{"className":989,"code":990,"language":991,"meta":992,"style":992},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# List roles\naws iam list-roles --query 'Roles[*].{Name:RoleName,Arn:Arn}' --output table\n\n# Get role's attached policies\naws iam list-attached-role-policies --role-name my-role\n\n# Get inline policy document\naws iam get-role-policy --role-name my-role --policy-name my-policy\n\n# Simulate policy evaluation\naws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:role\u002Fmy-role \\\n  --action-names s3:GetObject --resource-arns arn:aws:s3:::my-bucket\u002F*\n\n# Generate policy from Access Analyzer\naws accessanalyzer start-policy-generation --policy-generation-details '{\"principalArn\":\"arn:aws:iam::123456789012:role\u002Fmy-role\"}'\n\n# List Access Analyzer findings\naws accessanalyzer list-findings --analyzer-arn arn:aws:accessanalyzer:us-east-1:123456789012:analyzer\u002Fmy-analyzer \\\n  --query 'findings[?status==`ACTIVE`]'\n\n# Validate a policy\naws accessanalyzer validate-policy --policy-document file:\u002F\u002Fpolicy.json --policy-type IDENTITY_POLICY\n\n# Get credential report\naws iam generate-credential-report && sleep 5 && aws iam get-credential-report --query Content --output text | base64 -d\n\n# List users with access keys\naws iam list-users --query 'Users[*].UserName' --output text | xargs -I{} aws iam list-access-keys --user-name {}\n\n# Get last accessed services for a role\naws iam generate-service-last-accessed-details --arn arn:aws:iam::123456789012:role\u002Fmy-role\n\n# List Identity Center permission sets\naws sso-admin list-permission-sets --instance-arn arn:aws:sso:::instance\u002Fssoins-xxx\n\n# List SCPs\naws organizations list-policies --filter SERVICE_CONTROL_POLICY --query 'Policies[*].{Name:Name,Id:Id}'\n","bash","",[994],{"type":41,"tag":330,"props":995,"children":996},{"__ignoreMap":992},[997,1009,1060,1070,1079,1106,1114,1123,1159,1167,1176,1209,1238,1246,1254,1290,1298,1307,1338,1360,1368,1377,1414,1422,1431,1515,1523,1532,1593,1601,1610,1637,1645,1654,1682,1690,1699],{"type":41,"tag":998,"props":999,"children":1002},"span",{"class":1000,"line":1001},"line",1,[1003],{"type":41,"tag":998,"props":1004,"children":1006},{"style":1005},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1007],{"type":46,"value":1008},"# List roles\n",{"type":41,"tag":998,"props":1010,"children":1012},{"class":1000,"line":1011},2,[1013,1018,1024,1029,1034,1040,1045,1050,1055],{"type":41,"tag":998,"props":1014,"children":1016},{"style":1015},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1017],{"type":46,"value":22},{"type":41,"tag":998,"props":1019,"children":1021},{"style":1020},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1022],{"type":46,"value":1023}," iam",{"type":41,"tag":998,"props":1025,"children":1026},{"style":1020},[1027],{"type":46,"value":1028}," list-roles",{"type":41,"tag":998,"props":1030,"children":1031},{"style":1020},[1032],{"type":46,"value":1033}," --query",{"type":41,"tag":998,"props":1035,"children":1037},{"style":1036},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1038],{"type":46,"value":1039}," '",{"type":41,"tag":998,"props":1041,"children":1042},{"style":1020},[1043],{"type":46,"value":1044},"Roles[*].{Name:RoleName,Arn:Arn}",{"type":41,"tag":998,"props":1046,"children":1047},{"style":1036},[1048],{"type":46,"value":1049},"'",{"type":41,"tag":998,"props":1051,"children":1052},{"style":1020},[1053],{"type":46,"value":1054}," --output",{"type":41,"tag":998,"props":1056,"children":1057},{"style":1020},[1058],{"type":46,"value":1059}," table\n",{"type":41,"tag":998,"props":1061,"children":1063},{"class":1000,"line":1062},3,[1064],{"type":41,"tag":998,"props":1065,"children":1067},{"emptyLinePlaceholder":1066},true,[1068],{"type":46,"value":1069},"\n",{"type":41,"tag":998,"props":1071,"children":1073},{"class":1000,"line":1072},4,[1074],{"type":41,"tag":998,"props":1075,"children":1076},{"style":1005},[1077],{"type":46,"value":1078},"# Get role's attached policies\n",{"type":41,"tag":998,"props":1080,"children":1082},{"class":1000,"line":1081},5,[1083,1087,1091,1096,1101],{"type":41,"tag":998,"props":1084,"children":1085},{"style":1015},[1086],{"type":46,"value":22},{"type":41,"tag":998,"props":1088,"children":1089},{"style":1020},[1090],{"type":46,"value":1023},{"type":41,"tag":998,"props":1092,"children":1093},{"style":1020},[1094],{"type":46,"value":1095}," list-attached-role-policies",{"type":41,"tag":998,"props":1097,"children":1098},{"style":1020},[1099],{"type":46,"value":1100}," --role-name",{"type":41,"tag":998,"props":1102,"children":1103},{"style":1020},[1104],{"type":46,"value":1105}," my-role\n",{"type":41,"tag":998,"props":1107,"children":1109},{"class":1000,"line":1108},6,[1110],{"type":41,"tag":998,"props":1111,"children":1112},{"emptyLinePlaceholder":1066},[1113],{"type":46,"value":1069},{"type":41,"tag":998,"props":1115,"children":1117},{"class":1000,"line":1116},7,[1118],{"type":41,"tag":998,"props":1119,"children":1120},{"style":1005},[1121],{"type":46,"value":1122},"# Get inline policy document\n",{"type":41,"tag":998,"props":1124,"children":1126},{"class":1000,"line":1125},8,[1127,1131,1135,1140,1144,1149,1154],{"type":41,"tag":998,"props":1128,"children":1129},{"style":1015},[1130],{"type":46,"value":22},{"type":41,"tag":998,"props":1132,"children":1133},{"style":1020},[1134],{"type":46,"value":1023},{"type":41,"tag":998,"props":1136,"children":1137},{"style":1020},[1138],{"type":46,"value":1139}," get-role-policy",{"type":41,"tag":998,"props":1141,"children":1142},{"style":1020},[1143],{"type":46,"value":1100},{"type":41,"tag":998,"props":1145,"children":1146},{"style":1020},[1147],{"type":46,"value":1148}," my-role",{"type":41,"tag":998,"props":1150,"children":1151},{"style":1020},[1152],{"type":46,"value":1153}," --policy-name",{"type":41,"tag":998,"props":1155,"children":1156},{"style":1020},[1157],{"type":46,"value":1158}," my-policy\n",{"type":41,"tag":998,"props":1160,"children":1162},{"class":1000,"line":1161},9,[1163],{"type":41,"tag":998,"props":1164,"children":1165},{"emptyLinePlaceholder":1066},[1166],{"type":46,"value":1069},{"type":41,"tag":998,"props":1168,"children":1170},{"class":1000,"line":1169},10,[1171],{"type":41,"tag":998,"props":1172,"children":1173},{"style":1005},[1174],{"type":46,"value":1175},"# Simulate policy evaluation\n",{"type":41,"tag":998,"props":1177,"children":1179},{"class":1000,"line":1178},11,[1180,1184,1188,1193,1198,1203],{"type":41,"tag":998,"props":1181,"children":1182},{"style":1015},[1183],{"type":46,"value":22},{"type":41,"tag":998,"props":1185,"children":1186},{"style":1020},[1187],{"type":46,"value":1023},{"type":41,"tag":998,"props":1189,"children":1190},{"style":1020},[1191],{"type":46,"value":1192}," simulate-principal-policy",{"type":41,"tag":998,"props":1194,"children":1195},{"style":1020},[1196],{"type":46,"value":1197}," --policy-source-arn",{"type":41,"tag":998,"props":1199,"children":1200},{"style":1020},[1201],{"type":46,"value":1202}," arn:aws:iam::123456789012:role\u002Fmy-role",{"type":41,"tag":998,"props":1204,"children":1206},{"style":1205},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1207],{"type":46,"value":1208}," \\\n",{"type":41,"tag":998,"props":1210,"children":1212},{"class":1000,"line":1211},12,[1213,1218,1223,1228,1233],{"type":41,"tag":998,"props":1214,"children":1215},{"style":1020},[1216],{"type":46,"value":1217},"  --action-names",{"type":41,"tag":998,"props":1219,"children":1220},{"style":1020},[1221],{"type":46,"value":1222}," s3:GetObject",{"type":41,"tag":998,"props":1224,"children":1225},{"style":1020},[1226],{"type":46,"value":1227}," --resource-arns",{"type":41,"tag":998,"props":1229,"children":1230},{"style":1020},[1231],{"type":46,"value":1232}," arn:aws:s3:::my-bucket\u002F",{"type":41,"tag":998,"props":1234,"children":1235},{"style":1205},[1236],{"type":46,"value":1237},"*\n",{"type":41,"tag":998,"props":1239,"children":1241},{"class":1000,"line":1240},13,[1242],{"type":41,"tag":998,"props":1243,"children":1244},{"emptyLinePlaceholder":1066},[1245],{"type":46,"value":1069},{"type":41,"tag":998,"props":1247,"children":1248},{"class":1000,"line":23},[1249],{"type":41,"tag":998,"props":1250,"children":1251},{"style":1005},[1252],{"type":46,"value":1253},"# Generate policy from Access Analyzer\n",{"type":41,"tag":998,"props":1255,"children":1256},{"class":1000,"line":27},[1257,1261,1266,1271,1276,1280,1285],{"type":41,"tag":998,"props":1258,"children":1259},{"style":1015},[1260],{"type":46,"value":22},{"type":41,"tag":998,"props":1262,"children":1263},{"style":1020},[1264],{"type":46,"value":1265}," accessanalyzer",{"type":41,"tag":998,"props":1267,"children":1268},{"style":1020},[1269],{"type":46,"value":1270}," start-policy-generation",{"type":41,"tag":998,"props":1272,"children":1273},{"style":1020},[1274],{"type":46,"value":1275}," --policy-generation-details",{"type":41,"tag":998,"props":1277,"children":1278},{"style":1036},[1279],{"type":46,"value":1039},{"type":41,"tag":998,"props":1281,"children":1282},{"style":1020},[1283],{"type":46,"value":1284},"{\"principalArn\":\"arn:aws:iam::123456789012:role\u002Fmy-role\"}",{"type":41,"tag":998,"props":1286,"children":1287},{"style":1036},[1288],{"type":46,"value":1289},"'\n",{"type":41,"tag":998,"props":1291,"children":1293},{"class":1000,"line":1292},16,[1294],{"type":41,"tag":998,"props":1295,"children":1296},{"emptyLinePlaceholder":1066},[1297],{"type":46,"value":1069},{"type":41,"tag":998,"props":1299,"children":1301},{"class":1000,"line":1300},17,[1302],{"type":41,"tag":998,"props":1303,"children":1304},{"style":1005},[1305],{"type":46,"value":1306},"# List Access Analyzer findings\n",{"type":41,"tag":998,"props":1308,"children":1310},{"class":1000,"line":1309},18,[1311,1315,1319,1324,1329,1334],{"type":41,"tag":998,"props":1312,"children":1313},{"style":1015},[1314],{"type":46,"value":22},{"type":41,"tag":998,"props":1316,"children":1317},{"style":1020},[1318],{"type":46,"value":1265},{"type":41,"tag":998,"props":1320,"children":1321},{"style":1020},[1322],{"type":46,"value":1323}," list-findings",{"type":41,"tag":998,"props":1325,"children":1326},{"style":1020},[1327],{"type":46,"value":1328}," --analyzer-arn",{"type":41,"tag":998,"props":1330,"children":1331},{"style":1020},[1332],{"type":46,"value":1333}," arn:aws:accessanalyzer:us-east-1:123456789012:analyzer\u002Fmy-analyzer",{"type":41,"tag":998,"props":1335,"children":1336},{"style":1205},[1337],{"type":46,"value":1208},{"type":41,"tag":998,"props":1339,"children":1341},{"class":1000,"line":1340},19,[1342,1347,1351,1356],{"type":41,"tag":998,"props":1343,"children":1344},{"style":1020},[1345],{"type":46,"value":1346},"  --query",{"type":41,"tag":998,"props":1348,"children":1349},{"style":1036},[1350],{"type":46,"value":1039},{"type":41,"tag":998,"props":1352,"children":1353},{"style":1020},[1354],{"type":46,"value":1355},"findings[?status==`ACTIVE`]",{"type":41,"tag":998,"props":1357,"children":1358},{"style":1036},[1359],{"type":46,"value":1289},{"type":41,"tag":998,"props":1361,"children":1363},{"class":1000,"line":1362},20,[1364],{"type":41,"tag":998,"props":1365,"children":1366},{"emptyLinePlaceholder":1066},[1367],{"type":46,"value":1069},{"type":41,"tag":998,"props":1369,"children":1371},{"class":1000,"line":1370},21,[1372],{"type":41,"tag":998,"props":1373,"children":1374},{"style":1005},[1375],{"type":46,"value":1376},"# Validate a policy\n",{"type":41,"tag":998,"props":1378,"children":1380},{"class":1000,"line":1379},22,[1381,1385,1389,1394,1399,1404,1409],{"type":41,"tag":998,"props":1382,"children":1383},{"style":1015},[1384],{"type":46,"value":22},{"type":41,"tag":998,"props":1386,"children":1387},{"style":1020},[1388],{"type":46,"value":1265},{"type":41,"tag":998,"props":1390,"children":1391},{"style":1020},[1392],{"type":46,"value":1393}," validate-policy",{"type":41,"tag":998,"props":1395,"children":1396},{"style":1020},[1397],{"type":46,"value":1398}," --policy-document",{"type":41,"tag":998,"props":1400,"children":1401},{"style":1020},[1402],{"type":46,"value":1403}," file:\u002F\u002Fpolicy.json",{"type":41,"tag":998,"props":1405,"children":1406},{"style":1020},[1407],{"type":46,"value":1408}," --policy-type",{"type":41,"tag":998,"props":1410,"children":1411},{"style":1020},[1412],{"type":46,"value":1413}," IDENTITY_POLICY\n",{"type":41,"tag":998,"props":1415,"children":1417},{"class":1000,"line":1416},23,[1418],{"type":41,"tag":998,"props":1419,"children":1420},{"emptyLinePlaceholder":1066},[1421],{"type":46,"value":1069},{"type":41,"tag":998,"props":1423,"children":1425},{"class":1000,"line":1424},24,[1426],{"type":41,"tag":998,"props":1427,"children":1428},{"style":1005},[1429],{"type":46,"value":1430},"# Get credential report\n",{"type":41,"tag":998,"props":1432,"children":1434},{"class":1000,"line":1433},25,[1435,1439,1443,1448,1453,1458,1464,1468,1473,1477,1482,1486,1491,1495,1500,1505,1510],{"type":41,"tag":998,"props":1436,"children":1437},{"style":1015},[1438],{"type":46,"value":22},{"type":41,"tag":998,"props":1440,"children":1441},{"style":1020},[1442],{"type":46,"value":1023},{"type":41,"tag":998,"props":1444,"children":1445},{"style":1020},[1446],{"type":46,"value":1447}," generate-credential-report",{"type":41,"tag":998,"props":1449,"children":1450},{"style":1036},[1451],{"type":46,"value":1452}," &&",{"type":41,"tag":998,"props":1454,"children":1455},{"style":1015},[1456],{"type":46,"value":1457}," sleep",{"type":41,"tag":998,"props":1459,"children":1461},{"style":1460},"--shiki-light:#F76D47;--shiki-default:#F78C6C;--shiki-dark:#F78C6C",[1462],{"type":46,"value":1463}," 5",{"type":41,"tag":998,"props":1465,"children":1466},{"style":1036},[1467],{"type":46,"value":1452},{"type":41,"tag":998,"props":1469,"children":1470},{"style":1015},[1471],{"type":46,"value":1472}," aws",{"type":41,"tag":998,"props":1474,"children":1475},{"style":1020},[1476],{"type":46,"value":1023},{"type":41,"tag":998,"props":1478,"children":1479},{"style":1020},[1480],{"type":46,"value":1481}," get-credential-report",{"type":41,"tag":998,"props":1483,"children":1484},{"style":1020},[1485],{"type":46,"value":1033},{"type":41,"tag":998,"props":1487,"children":1488},{"style":1020},[1489],{"type":46,"value":1490}," Content",{"type":41,"tag":998,"props":1492,"children":1493},{"style":1020},[1494],{"type":46,"value":1054},{"type":41,"tag":998,"props":1496,"children":1497},{"style":1020},[1498],{"type":46,"value":1499}," text",{"type":41,"tag":998,"props":1501,"children":1502},{"style":1036},[1503],{"type":46,"value":1504}," |",{"type":41,"tag":998,"props":1506,"children":1507},{"style":1015},[1508],{"type":46,"value":1509}," base64",{"type":41,"tag":998,"props":1511,"children":1512},{"style":1020},[1513],{"type":46,"value":1514}," -d\n",{"type":41,"tag":998,"props":1516,"children":1518},{"class":1000,"line":1517},26,[1519],{"type":41,"tag":998,"props":1520,"children":1521},{"emptyLinePlaceholder":1066},[1522],{"type":46,"value":1069},{"type":41,"tag":998,"props":1524,"children":1526},{"class":1000,"line":1525},27,[1527],{"type":41,"tag":998,"props":1528,"children":1529},{"style":1005},[1530],{"type":46,"value":1531},"# List users with access keys\n",{"type":41,"tag":998,"props":1533,"children":1535},{"class":1000,"line":1534},28,[1536,1540,1544,1549,1553,1557,1562,1566,1570,1574,1578,1583,1588],{"type":41,"tag":998,"props":1537,"children":1538},{"style":1015},[1539],{"type":46,"value":22},{"type":41,"tag":998,"props":1541,"children":1542},{"style":1020},[1543],{"type":46,"value":1023},{"type":41,"tag":998,"props":1545,"children":1546},{"style":1020},[1547],{"type":46,"value":1548}," list-users",{"type":41,"tag":998,"props":1550,"children":1551},{"style":1020},[1552],{"type":46,"value":1033},{"type":41,"tag":998,"props":1554,"children":1555},{"style":1036},[1556],{"type":46,"value":1039},{"type":41,"tag":998,"props":1558,"children":1559},{"style":1020},[1560],{"type":46,"value":1561},"Users[*].UserName",{"type":41,"tag":998,"props":1563,"children":1564},{"style":1036},[1565],{"type":46,"value":1049},{"type":41,"tag":998,"props":1567,"children":1568},{"style":1020},[1569],{"type":46,"value":1054},{"type":41,"tag":998,"props":1571,"children":1572},{"style":1020},[1573],{"type":46,"value":1499},{"type":41,"tag":998,"props":1575,"children":1576},{"style":1036},[1577],{"type":46,"value":1504},{"type":41,"tag":998,"props":1579,"children":1580},{"style":1015},[1581],{"type":46,"value":1582}," xargs",{"type":41,"tag":998,"props":1584,"children":1585},{"style":1020},[1586],{"type":46,"value":1587}," -I",{"type":41,"tag":998,"props":1589,"children":1590},{"style":1205},[1591],{"type":46,"value":1592},"{} aws iam list-access-keys --user-name {}\n",{"type":41,"tag":998,"props":1594,"children":1596},{"class":1000,"line":1595},29,[1597],{"type":41,"tag":998,"props":1598,"children":1599},{"emptyLinePlaceholder":1066},[1600],{"type":46,"value":1069},{"type":41,"tag":998,"props":1602,"children":1604},{"class":1000,"line":1603},30,[1605],{"type":41,"tag":998,"props":1606,"children":1607},{"style":1005},[1608],{"type":46,"value":1609},"# Get last accessed services for a role\n",{"type":41,"tag":998,"props":1611,"children":1613},{"class":1000,"line":1612},31,[1614,1618,1622,1627,1632],{"type":41,"tag":998,"props":1615,"children":1616},{"style":1015},[1617],{"type":46,"value":22},{"type":41,"tag":998,"props":1619,"children":1620},{"style":1020},[1621],{"type":46,"value":1023},{"type":41,"tag":998,"props":1623,"children":1624},{"style":1020},[1625],{"type":46,"value":1626}," generate-service-last-accessed-details",{"type":41,"tag":998,"props":1628,"children":1629},{"style":1020},[1630],{"type":46,"value":1631}," --arn",{"type":41,"tag":998,"props":1633,"children":1634},{"style":1020},[1635],{"type":46,"value":1636}," arn:aws:iam::123456789012:role\u002Fmy-role\n",{"type":41,"tag":998,"props":1638,"children":1640},{"class":1000,"line":1639},32,[1641],{"type":41,"tag":998,"props":1642,"children":1643},{"emptyLinePlaceholder":1066},[1644],{"type":46,"value":1069},{"type":41,"tag":998,"props":1646,"children":1648},{"class":1000,"line":1647},33,[1649],{"type":41,"tag":998,"props":1650,"children":1651},{"style":1005},[1652],{"type":46,"value":1653},"# List Identity Center permission sets\n",{"type":41,"tag":998,"props":1655,"children":1657},{"class":1000,"line":1656},34,[1658,1662,1667,1672,1677],{"type":41,"tag":998,"props":1659,"children":1660},{"style":1015},[1661],{"type":46,"value":22},{"type":41,"tag":998,"props":1663,"children":1664},{"style":1020},[1665],{"type":46,"value":1666}," sso-admin",{"type":41,"tag":998,"props":1668,"children":1669},{"style":1020},[1670],{"type":46,"value":1671}," list-permission-sets",{"type":41,"tag":998,"props":1673,"children":1674},{"style":1020},[1675],{"type":46,"value":1676}," --instance-arn",{"type":41,"tag":998,"props":1678,"children":1679},{"style":1020},[1680],{"type":46,"value":1681}," arn:aws:sso:::instance\u002Fssoins-xxx\n",{"type":41,"tag":998,"props":1683,"children":1685},{"class":1000,"line":1684},35,[1686],{"type":41,"tag":998,"props":1687,"children":1688},{"emptyLinePlaceholder":1066},[1689],{"type":46,"value":1069},{"type":41,"tag":998,"props":1691,"children":1693},{"class":1000,"line":1692},36,[1694],{"type":41,"tag":998,"props":1695,"children":1696},{"style":1005},[1697],{"type":46,"value":1698},"# List SCPs\n",{"type":41,"tag":998,"props":1700,"children":1702},{"class":1000,"line":1701},37,[1703,1707,1712,1717,1722,1727,1731,1735,1740],{"type":41,"tag":998,"props":1704,"children":1705},{"style":1015},[1706],{"type":46,"value":22},{"type":41,"tag":998,"props":1708,"children":1709},{"style":1020},[1710],{"type":46,"value":1711}," organizations",{"type":41,"tag":998,"props":1713,"children":1714},{"style":1020},[1715],{"type":46,"value":1716}," list-policies",{"type":41,"tag":998,"props":1718,"children":1719},{"style":1020},[1720],{"type":46,"value":1721}," --filter",{"type":41,"tag":998,"props":1723,"children":1724},{"style":1020},[1725],{"type":46,"value":1726}," SERVICE_CONTROL_POLICY",{"type":41,"tag":998,"props":1728,"children":1729},{"style":1020},[1730],{"type":46,"value":1033},{"type":41,"tag":998,"props":1732,"children":1733},{"style":1036},[1734],{"type":46,"value":1039},{"type":41,"tag":998,"props":1736,"children":1737},{"style":1020},[1738],{"type":46,"value":1739},"Policies[*].{Name:Name,Id:Id}",{"type":41,"tag":998,"props":1741,"children":1742},{"style":1036},[1743],{"type":46,"value":1289},{"type":41,"tag":49,"props":1745,"children":1747},{"id":1746},"anti-patterns",[1748],{"type":46,"value":1749},"Anti-Patterns",{"type":41,"tag":273,"props":1751,"children":1752},{},[1753,1763,1783,1793,1803,1813,1823,1839,1854,1864],{"type":41,"tag":65,"props":1754,"children":1755},{},[1756,1761],{"type":41,"tag":69,"props":1757,"children":1758},{},[1759],{"type":46,"value":1760},"IAM users for workloads",{"type":46,"value":1762},": Never create IAM users with access keys for applications. Use IAM roles with temporary credentials via instance profiles, task roles, or AssumeRole.",{"type":41,"tag":65,"props":1764,"children":1765},{},[1766,1781],{"type":41,"tag":69,"props":1767,"children":1768},{},[1769,1774,1776],{"type":41,"tag":330,"props":1770,"children":1772},{"className":1771},[],[1773],{"type":46,"value":498},{"type":46,"value":1775}," on ",{"type":41,"tag":330,"props":1777,"children":1779},{"className":1778},[],[1780],{"type":46,"value":506},{"type":46,"value":1782},": Overly permissive. Always scope to specific actions and resources. Use Access Analyzer to determine what's actually needed.",{"type":41,"tag":65,"props":1784,"children":1785},{},[1786,1791],{"type":41,"tag":69,"props":1787,"children":1788},{},[1789],{"type":46,"value":1790},"Inline policies on users",{"type":46,"value":1792},": Use groups for human access, roles for workloads. Inline policies on individual users are unmaintainable.",{"type":41,"tag":65,"props":1794,"children":1795},{},[1796,1801],{"type":41,"tag":69,"props":1797,"children":1798},{},[1799],{"type":46,"value":1800},"Long-lived access keys without rotation",{"type":46,"value":1802},": If you must use access keys (you shouldn't), rotate every 90 days. Better: eliminate them entirely.",{"type":41,"tag":65,"props":1804,"children":1805},{},[1806,1811],{"type":41,"tag":69,"props":1807,"children":1808},{},[1809],{"type":46,"value":1810},"Not using permission boundaries for delegated admin",{"type":46,"value":1812},": If developers can create IAM roles, they can escalate privileges. Permission boundaries prevent this.",{"type":41,"tag":65,"props":1814,"children":1815},{},[1816,1821],{"type":41,"tag":69,"props":1817,"children":1818},{},[1819],{"type":46,"value":1820},"SCPs that don't exempt a break-glass role",{"type":46,"value":1822},": If you lock something down with SCPs and have no escape hatch, you'll be locked out during incidents.",{"type":41,"tag":65,"props":1824,"children":1825},{},[1826,1837],{"type":41,"tag":69,"props":1827,"children":1828},{},[1829,1835],{"type":41,"tag":330,"props":1830,"children":1832},{"className":1831},[],[1833],{"type":46,"value":1834},"iam:PassRole",{"type":46,"value":1836}," without resource constraint",{"type":46,"value":1838},": PassRole lets an entity assign a role to a service. Without constraining which roles can be passed, it's a privilege escalation path.",{"type":41,"tag":65,"props":1840,"children":1841},{},[1842,1852],{"type":41,"tag":69,"props":1843,"children":1844},{},[1845,1847],{"type":46,"value":1846},"Not using ",{"type":41,"tag":330,"props":1848,"children":1850},{"className":1849},[],[1851],{"type":46,"value":538},{"type":46,"value":1853},": When granting cross-account access within an org, use this condition instead of listing individual account IDs. Easier to maintain and automatically includes new accounts.",{"type":41,"tag":65,"props":1855,"children":1856},{},[1857,1862],{"type":41,"tag":69,"props":1858,"children":1859},{},[1860],{"type":46,"value":1861},"Ignoring Access Analyzer findings",{"type":46,"value":1863},": External access findings tell you what's shared outside your account. Unreviewed findings are unmanaged risk.",{"type":41,"tag":65,"props":1865,"children":1866},{},[1867,1872,1874,1880],{"type":41,"tag":69,"props":1868,"children":1869},{},[1870],{"type":46,"value":1871},"MFA not enforced for console access",{"type":46,"value":1873},": All human users must have MFA. Enforce it via Identity Center or with an IAM policy condition ",{"type":41,"tag":330,"props":1875,"children":1877},{"className":1876},[],[1878],{"type":46,"value":1879},"aws:MultiFactorAuthPresent",{"type":46,"value":1881},".",{"type":41,"tag":49,"props":1883,"children":1885},{"id":1884},"reference-files",[1886],{"type":46,"value":1887},"Reference Files",{"type":41,"tag":145,"props":1889,"children":1890},{},[1891,1907],{"type":41,"tag":149,"props":1892,"children":1893},{},[1894],{"type":41,"tag":153,"props":1895,"children":1896},{},[1897,1902],{"type":41,"tag":157,"props":1898,"children":1899},{},[1900],{"type":46,"value":1901},"File",{"type":41,"tag":157,"props":1903,"children":1904},{},[1905],{"type":46,"value":1906},"Contents",{"type":41,"tag":173,"props":1908,"children":1909},{},[1910,1926],{"type":41,"tag":153,"props":1911,"children":1912},{},[1913,1921],{"type":41,"tag":180,"props":1914,"children":1915},{},[1916],{"type":41,"tag":330,"props":1917,"children":1919},{"className":1918},[],[1920],{"type":46,"value":335},{"type":41,"tag":180,"props":1922,"children":1923},{},[1924],{"type":46,"value":1925},"Identity-based policies, trust policies (Lambda, EC2, ECS, cross-account, SAML, GitHub Actions OIDC), resource-based policies (S3, KMS, SQS), permission boundaries, SCP examples, condition keys reference",{"type":41,"tag":153,"props":1927,"children":1928},{},[1929,1938],{"type":41,"tag":180,"props":1930,"children":1931},{},[1932],{"type":41,"tag":330,"props":1933,"children":1935},{"className":1934},[],[1936],{"type":46,"value":1937},"references\u002Frole-templates.md",{"type":41,"tag":180,"props":1939,"children":1940},{},[1941],{"type":46,"value":1942},"Persona-based role templates with trust and identity policies: Developer, Data Engineer, On-Call\u002FOperations, CI\u002FCD Pipeline, Read-Only Auditor, plus a shared permission boundary",{"type":41,"tag":49,"props":1944,"children":1946},{"id":1945},"related-skills",[1947],{"type":46,"value":1948},"Related Skills",{"type":41,"tag":273,"props":1950,"children":1951},{},[1952,1963,1974,1985,1996,2007],{"type":41,"tag":65,"props":1953,"children":1954},{},[1955,1961],{"type":41,"tag":330,"props":1956,"children":1958},{"className":1957},[],[1959],{"type":46,"value":1960},"security-review",{"type":46,"value":1962}," -- comprehensive security audit and IaC review",{"type":41,"tag":65,"props":1964,"children":1965},{},[1966,1972],{"type":41,"tag":330,"props":1967,"children":1969},{"className":1968},[],[1970],{"type":46,"value":1971},"aws-architect",{"type":46,"value":1973}," -- well-architected design guidance",{"type":41,"tag":65,"props":1975,"children":1976},{},[1977,1983],{"type":41,"tag":330,"props":1978,"children":1980},{"className":1979},[],[1981],{"type":46,"value":1982},"networking",{"type":46,"value":1984}," -- VPC, subnets, security groups, NACLs",{"type":41,"tag":65,"props":1986,"children":1987},{},[1988,1994],{"type":41,"tag":330,"props":1989,"children":1991},{"className":1990},[],[1992],{"type":46,"value":1993},"lambda",{"type":46,"value":1995}," -- Lambda execution roles and resource policies",{"type":41,"tag":65,"props":1997,"children":1998},{},[1999,2005],{"type":41,"tag":330,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":46,"value":2004},"ecs",{"type":46,"value":2006}," -- ECS task roles vs task execution roles",{"type":41,"tag":65,"props":2008,"children":2009},{},[2010,2016],{"type":41,"tag":330,"props":2011,"children":2013},{"className":2012},[],[2014],{"type":46,"value":2015},"eks",{"type":46,"value":2017}," -- Kubernetes RBAC and IRSA (IAM Roles for Service Accounts)",{"type":41,"tag":2019,"props":2020,"children":2021},"style",{},[2022],{"type":46,"value":2023},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":2025,"total":2121},[2026,2038,2053,2065,2076,2089,2106],{"slug":2027,"name":2027,"fn":2028,"description":2029,"org":2030,"tags":2031,"stars":23,"repoUrl":24,"updatedAt":2037},"agentcore","design Amazon Bedrock AgentCore architectures","Deep-dive into Amazon Bedrock AgentCore platform design, service selection, deployment, and production operations. This skill should be used when the user asks to \"design an AgentCore architecture\", \"deploy agents on AgentCore\", \"configure AgentCore Runtime\", \"set up AgentCore Memory\", \"use AgentCore Gateway\", \"configure AgentCore Identity\", \"set up AgentCore Policy\", \"plan agent observability\", \"evaluate agent quality\", \"move agent PoC to production\", or mentions AgentCore, AgentCore Runtime, AgentCore Memory, AgentCore Gateway, AgentCore Identity, AgentCore Policy, AgentCore Evaluations, AgentCore Code Interpreter, AgentCore Browser, A2A protocol, or multi-agent orchestration on AWS.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2032,2035,2036],{"name":2033,"slug":2034,"type":16},"Agents","agents",{"name":703,"slug":700,"type":16},{"name":21,"slug":22,"type":16},"2026-07-12T08:40:11.108951",{"slug":2039,"name":2039,"fn":2040,"description":2041,"org":2042,"tags":2043,"stars":23,"repoUrl":24,"updatedAt":2052},"aidlc-lite","develop AI applications on AWS","Lightweight AI development lifecycle for building on AWS. A simplified take on the AI-DLC philosophy — think together, then build fast. Acts as a design partner that understands intent, proposes alternatives with trade-offs, and ships working code without the ceremony of full requirements\u002Fdesign\u002Fspec documents. Use when a founder says \"build X on AWS\", \"add Y to my stack\", \"scaffold an API\", or \"write the CDK for Z\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2044,2045,2048,2049],{"name":2033,"slug":2034,"type":16},{"name":2046,"slug":2047,"type":16},"AI Infrastructure","ai-infrastructure",{"name":21,"slug":22,"type":16},{"name":2050,"slug":2051,"type":16},"Engineering","engineering","2026-07-12T08:40:40.204103",{"slug":2054,"name":2054,"fn":2055,"description":2056,"org":2057,"tags":2058,"stars":23,"repoUrl":24,"updatedAt":2064},"architect-for-startups","advise on AWS architecture for startups","AWS architecture advisor tailored specifically for startups. Alters AWS architecture recommendations based on startup stage (pre-revenue through Series B+), team size, runway, and credits. ALWAYS use when asked about building on AWS, choosing services, planning infrastructure, managing costs with credits, or preparing architecture for fundraising.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2059,2060,2061],{"name":703,"slug":700,"type":16},{"name":21,"slug":22,"type":16},{"name":2062,"slug":2063,"type":16},"Strategy","strategy","2026-07-12T08:41:33.557354",{"slug":1971,"name":1971,"fn":2066,"description":2067,"org":2068,"tags":2069,"stars":23,"repoUrl":24,"updatedAt":2075},"design and review AWS architectures","Design and review AWS architectures following Well-Architected Framework principles. Use when planning new infrastructure, reviewing existing architectures, evaluating trade-offs between AWS services, or when asked about AWS best practices.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2070,2071,2072],{"name":703,"slug":700,"type":16},{"name":21,"slug":22,"type":16},{"name":2073,"slug":2074,"type":16},"Infrastructure","infrastructure","2026-07-12T08:40:57.630086",{"slug":2077,"name":2077,"fn":2078,"description":2079,"org":2080,"tags":2081,"stars":23,"repoUrl":24,"updatedAt":2088},"aws-compare","compare AWS architecture options","Compare 2-3 AWS architecture options side-by-side across cost, complexity, performance, security, and operational burden. Use when evaluating trade-offs between approaches or when the user is deciding between options.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2082,2083,2084,2087],{"name":703,"slug":700,"type":16},{"name":21,"slug":22,"type":16},{"name":2085,"slug":2086,"type":16},"Cost Optimization","cost-optimization",{"name":14,"slug":15,"type":16},"2026-07-12T08:40:23.960287",{"slug":2090,"name":2090,"fn":2091,"description":2092,"org":2093,"tags":2094,"stars":23,"repoUrl":24,"updatedAt":2105},"aws-debug","debug AWS infrastructure and deployment failures","Debug AWS infrastructure issues, deployment failures, and runtime errors. Use when troubleshooting CloudFormation stack failures, Lambda errors, ECS task failures, permission issues, networking problems, or any AWS service misbehavior.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2095,2096,2099,2102],{"name":21,"slug":22,"type":16},{"name":2097,"slug":2098,"type":16},"Debugging","debugging",{"name":2100,"slug":2101,"type":16},"Deployment","deployment",{"name":2103,"slug":2104,"type":16},"Observability","observability","2026-07-12T08:40:16.767171",{"slug":2107,"name":2107,"fn":2108,"description":2109,"org":2110,"tags":2111,"stars":23,"repoUrl":24,"updatedAt":2120},"aws-diagram","generate AWS architecture diagrams","Generate AWS architecture diagrams in Mermaid or ASCII from a description, existing IaC, or conversation context. Use when the user wants to visualize an architecture.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2112,2113,2114,2117],{"name":703,"slug":700,"type":16},{"name":21,"slug":22,"type":16},{"name":2115,"slug":2116,"type":16},"Diagrams","diagrams",{"name":2118,"slug":2119,"type":16},"Visualization","visualization","2026-07-12T08:40:43.26341",42,{"items":2123,"total":2295},[2124,2139,2160,2170,2183,2196,2206,2216,2235,2250,2265,2280],{"slug":2125,"name":2125,"fn":2126,"description":2127,"org":2128,"tags":2129,"stars":2136,"repoUrl":2137,"updatedAt":2138},"agentcore-investigation","investigate Bedrock AgentCore runtime sessions","Investigate Bedrock AgentCore runtime sessions via CloudWatch Logs Insights — resolve session\u002Ftrace IDs, query OTEL spans, filter noise, build timelines. Use when debugging AgentCore agent sessions, tracing tool calls, or analyzing latency.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2130,2131,2132,2135],{"name":21,"slug":22,"type":16},{"name":2097,"slug":2098,"type":16},{"name":2133,"slug":2134,"type":16},"Logs","logs",{"name":2103,"slug":2104,"type":16},9427,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fmcp","2026-07-12T08:37:22.601527",{"slug":2140,"name":2141,"fn":2142,"description":2143,"org":2144,"tags":2145,"stars":2136,"repoUrl":2137,"updatedAt":2159},"amazon-aurora-dsql","amazon aurora dsql","build applications with Aurora DSQL","Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django\u002FHibernate\u002FRails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2146,2149,2150,2153,2156],{"name":2147,"slug":2148,"type":16},"Aurora","aurora",{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},"Database","database",{"name":2154,"slug":2155,"type":16},"Serverless","serverless",{"name":2157,"slug":2158,"type":16},"SQL","sql","2026-07-12T08:36:45.053393",{"slug":2161,"name":2162,"fn":2142,"description":2143,"org":2163,"tags":2164,"stars":2136,"repoUrl":2137,"updatedAt":2169},"aurora-dsql","aurora dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2165,2166,2167,2168],{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},{"name":2154,"slug":2155,"type":16},{"name":2157,"slug":2158,"type":16},"2026-07-12T08:36:42.694299",{"slug":2171,"name":2172,"fn":2142,"description":2143,"org":2173,"tags":2174,"stars":2136,"repoUrl":2137,"updatedAt":2182},"aws-dsql","aws dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2175,2176,2177,2180,2181],{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},{"name":2178,"slug":2179,"type":16},"Migration","migration",{"name":2154,"slug":2155,"type":16},{"name":2157,"slug":2158,"type":16},"2026-07-12T08:36:38.584057",{"slug":2184,"name":2185,"fn":2142,"description":2143,"org":2186,"tags":2187,"stars":2136,"repoUrl":2137,"updatedAt":2195},"distributed-postgres","distributed postgres",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2188,2189,2190,2193,2194],{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},{"name":2191,"slug":2192,"type":16},"PostgreSQL","postgresql",{"name":2154,"slug":2155,"type":16},{"name":2157,"slug":2158,"type":16},"2026-07-12T08:36:46.530743",{"slug":2197,"name":2198,"fn":2142,"description":2143,"org":2199,"tags":2200,"stars":2136,"repoUrl":2137,"updatedAt":2205},"distributed-sql","distributed sql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2201,2202,2203,2204],{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},{"name":2154,"slug":2155,"type":16},{"name":2157,"slug":2158,"type":16},"2026-07-12T08:36:48.104182",{"slug":2207,"name":2207,"fn":2142,"description":2143,"org":2208,"tags":2209,"stars":2136,"repoUrl":2137,"updatedAt":2215},"dsql",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2210,2211,2212,2213,2214],{"name":21,"slug":22,"type":16},{"name":2151,"slug":2152,"type":16},{"name":2178,"slug":2179,"type":16},{"name":2154,"slug":2155,"type":16},{"name":2157,"slug":2158,"type":16},"2026-07-12T08:36:36.374512",{"slug":2217,"name":2217,"fn":2218,"description":2219,"org":2220,"tags":2221,"stars":2232,"repoUrl":2233,"updatedAt":2234},"cost-efficiency-analyzer","analyze cost efficiency and expenses","Analyzes cost structure, cost efficiency, and expense management from P&L data. Use when the user asks about costs, expenses, COGS, operating expenses, cost ratios, cost control, spending efficiency, margin compression from cost side, or wants to understand where money is going. Also use for \"are we spending too much\", \"cost breakdown\", \"expense analysis\", or \"how efficient are our operations\". NOT for revenue or top-line analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2222,2225,2228,2229],{"name":2223,"slug":2224,"type":16},"Accounting","accounting",{"name":2226,"slug":2227,"type":16},"Analytics","analytics",{"name":2085,"slug":2086,"type":16},{"name":2230,"slug":2231,"type":16},"Finance","finance",3176,"https:\u002F\u002Fgithub.com\u002Fawslabs\u002Fagentcore-samples","2026-07-12T08:40:03.29555",{"slug":2236,"name":2236,"fn":2237,"description":2238,"org":2239,"tags":2240,"stars":2232,"repoUrl":2233,"updatedAt":2249},"executive-financial-briefing","generate executive financial briefings","Generates a concise executive-level financial briefing or summary suitable for a CEO, CFO, or board presentation. Use when the user asks for a summary, briefing, executive summary, board update, financial overview, financial health check, or \"how is the business doing\". Covers the full P&L picture in one page. Also use for \"give me the highlights\", \"what do I need to know\", or \"quick financial update\".",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2241,2242,2243,2246],{"name":21,"slug":22,"type":16},{"name":2230,"slug":2231,"type":16},{"name":2244,"slug":2245,"type":16},"Management","management",{"name":2247,"slug":2248,"type":16},"Reporting","reporting","2026-07-12T08:40:02.066471",{"slug":2251,"name":2251,"fn":2252,"description":2253,"org":2254,"tags":2255,"stars":2232,"repoUrl":2233,"updatedAt":2264},"multi-quarter-trend-analysis","analyze multi-quarter financial trends","Analyzes financial trends across multiple quarters by comparing P&L metrics over time. Use when the user wants to see trends, patterns, trajectories, or directional movement across 3 or more quarters. Also use for \"how are we trending\", \"show me the trend\", \"track performance over time\", \"quarter over quarter comparison across all quarters\", or any multi-period longitudinal analysis.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2256,2257,2258,2261],{"name":2226,"slug":2227,"type":16},{"name":2230,"slug":2231,"type":16},{"name":2259,"slug":2260,"type":16},"Financial Statements","financial-statements",{"name":2262,"slug":2263,"type":16},"Variance Analysis","variance-analysis","2026-07-12T08:40:00.79141",{"slug":2266,"name":2266,"fn":2267,"description":2268,"org":2269,"tags":2270,"stars":2232,"repoUrl":2233,"updatedAt":2279},"pdf","process and manipulate PDF documents","Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text\u002Ftables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting\u002Fdecrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2271,2274,2277],{"name":2272,"slug":2273,"type":16},"Automation","automation",{"name":2275,"slug":2276,"type":16},"Documents","documents",{"name":2278,"slug":2266,"type":16},"PDF","2026-07-12T08:41:44.135656",{"slug":2281,"name":2281,"fn":2282,"description":2283,"org":2284,"tags":2285,"stars":2232,"repoUrl":2233,"updatedAt":2294},"quarterly-kpi-calculator","calculate quarterly financial KPIs","Calculates quarterly financial KPIs from P&L data. P&L figures can be provided directly by the user or fetched from the financial data MCP server. Use when the user wants KPI calculations such as Gross Margin %, EBITDA Margin %, Operating Expense Ratio, or Revenue Growth % QoQ. Also use for quarterly performance review, P&L analysis, or interpreting financial ratios against benchmarks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[2286,2287,2290,2291],{"name":2223,"slug":2224,"type":16},{"name":2288,"slug":2289,"type":16},"Data Analysis","data-analysis",{"name":2230,"slug":2231,"type":16},{"name":2292,"slug":2293,"type":16},"KPI","kpi","2026-07-12T08:39:59.54971",150]