cloudthinker-ai AWS IAM Deep Analysis Skill
Safely read and audit AWS IAM — the identity and access management service for AWS.
MANDATORY: Discovery-First Pattern
Always discover the account context, IAM entities, and existing policies before analyzing permissions. Never guess ARNs or policy names.
Phase 1: Discovery
#!/bin/bash
echo "=== Account Identity ==="
aws sts get-caller-identity | jq '{
account: .Account,
arn: .Arn,
user_id: .UserId
}'
echo ""
echo "=== Account Summary ==="
aws iam get-account-summary | jq '.SummaryMap | {
Users: .Users,
Groups: .Groups,
Roles: .Roles,
Policies: .Policies,
MFADevices: .MFADevices,
AccessKeysPerUserQuota: .AccessKeysPerUserQuota,
AccountMFAEnabled: .AccountMFAEnabled,
ServerCertificates: .ServerCertificates
}'
echo ""
echo "=== IAM Users (first 20) ==="
aws iam list-users --max-items 20 | jq -r '.Users[] | "\(.UserName)\t\(.UserId)\t\(.CreateDate)\t\(.PasswordLastUsed // "Never")"' | column -t
echo ""
echo "=== IAM Roles (first 20) ==="
aws iam list-roles --max-items 20 | jq -r '.Roles[] | "\(.RoleName)\t\(.Arn)\t\(.CreateDate)"' | column -t
echo ""
echo "=== Customer Managed Policies ==="
aws iam list-policies --scope Local --max-items 20 | jq -r '.Policies[] | "\(.PolicyName)\t\(.Arn)\t\(.AttachmentCount)"' | column -t
Phase 1 outputs: Account context, user/role/policy inventory — only reference these in subsequent operations.
Anti-Hallucination Rules
- NEVER guess ARNs or policy names — always list entities in Phase 1
- NEVER assume trust relationships — always read role trust policy documents
- NEVER fabricate permission sets — always read actual policy documents
- ONLY read and describe — never create, update, or delete without explicit request
Safety Rules
- READ-ONLY by default:
get-*,list-*,describe-*,generate-credential-report,get-credential-report - MASK sensitive data: Redact access key secrets, never display full credential report passwords
- FORBIDDEN without explicit request:
create-*,delete-*,put-*,attach-*,detach-*,update-* - NEVER print secret keys: Access key IDs are fine; secret access keys must never be displayed
Core Helper Functions
#!/bin/bash
# Get effective policy for a user (all attached + inline)
get_user_effective_policies() {
local username="$1"
echo "--- Attached Policies ---"
aws iam list-attached-user-policies --user-name "$username" | jq -r '.AttachedPolicies[] | "\(.PolicyName)\t\(.PolicyArn)"' | column -t
echo "--- Inline Policies ---"
aws iam list-user-policies --user-name "$username" | jq -r '.PolicyNames[]'
echo "--- Group Memberships ---"
aws iam list-groups-for-user --user-name "$username" | jq -r '.Groups[] | .GroupName' | while read group; do
echo " Group: $group"
aws iam list-attached-group-policies --group-name "$group" | jq -r ' .AttachedPolicies[] | " \(.PolicyName)"'
done
}
# Read a policy document by ARN
read_policy_document() {
local policy_arn="$1"
local version=$(aws iam get-policy --policy-arn "$policy_arn" | jq -r '.Policy.DefaultVersionId')
aws iam get-policy-version --policy-arn "$policy_arn" --version-id "$version" | jq '.PolicyVersion.Document'
}
Common Operations
Policy Analysis
#!/bin/bash
POLICY_ARN="${1:?Policy ARN required — discover via Phase 1}"
echo "=== Policy Metadata ==="
aws iam get-policy --policy-arn "$POLICY_ARN" | jq '{
name: .Policy.PolicyName,
arn: .Policy.Arn,
default_version: .Policy.DefaultVersionId,
attachment_count: .Policy.AttachmentCount,
is_attachable: .Policy.IsAttachable,
create_date: .Policy.CreateDate,
update_date: .Policy.UpdateDate
}'
echo ""
echo "=== Policy Document ==="
VERSION=$(aws iam get-policy --policy-arn "$POLICY_ARN" | jq -r '.Policy.DefaultVersionId')
aws iam get-policy-version --policy-arn "$POLICY_ARN" --version-id "$VERSION" | jq '.PolicyVersion.Document'
echo ""
echo "=== Entities Attached To ==="
aws iam list-entities-for-policy --policy-arn "$POLICY_ARN" | jq '{
groups: [.PolicyGroups[].GroupName],
users: [.PolicyUsers[].UserName],
roles: [.PolicyRoles[].RoleName]
}'
Role Trust Relationship Review
#!/bin/bash
ROLE_NAME="${1:?Role name required}"
echo "=== Role: $ROLE_NAME ==="
aws iam get-role --role-name "$ROLE_NAME" | jq '{
arn: .Role.Arn,
create_date: .Role.CreateDate,
max_session_duration: .Role.MaxSessionDuration,
permissions_boundary: (.Role.PermissionsBoundary.PermissionsBoundaryArn // "None"),
trust_policy: .Role.AssumeRolePolicyDocument
}'
echo ""
echo "=== Attached Policies ==="
aws iam list-attached-role-policies --role-name "$ROLE_NAME" | jq -r '.AttachedPolicies[] | "\(.PolicyName)\t\(.PolicyArn)"' | column -t
echo ""
echo "=== Inline Policies ==="
aws iam list-role-policies --role-name "$ROLE_NAME" | jq -r '.PolicyNames[]' | while read policy; do
echo "--- $policy ---"
aws iam get-role-policy --role-name "$ROLE_NAME" --policy-name "$policy" | jq '.PolicyDocument'
done
echo ""
echo "=== Trust Policy Analysis ==="
aws iam get-role --role-name "$ROLE_NAME" | jq '.Role.AssumeRolePolicyDocument.Statement[] | {
effect: .Effect,
principal: .Principal,
action: .Action,
condition: (.Condition // "None")
}'
Credential Report & Access Keys
#!/bin/bash
echo "=== Generating Credential Report ==="
aws iam generate-credential-report > /dev/null 2>&1
sleep 3
aws iam generate-credential-report | jq -r '.State'
echo ""
echo "=== Credential Report Summary ==="
aws iam get-credential-report | jq -r '.Content' | base64 -d | head -1
aws iam get-credential-report | jq -r '.Content' | base64 -d | tail -n +2 | while IFS=',' read -r user arn created pw_enabled pw_last_used pw_last_changed pw_next_rotation mfa_active key1_active key1_last_rotated key1_last_used rest; do
echo "User: $user | MFA: $mfa_active | PW Enabled: $pw_enabled | Key1 Active: $key1_active"
done | head -20
echo ""
echo "=== Users Without MFA ==="
aws iam get-credential-report | jq -r '.Content' | base64 -d | awk -F',' 'NR>1 && $4=="true" && $8=="false" {print "WARNING: "$1" has password but NO MFA"}'
echo ""
echo "=== Old Access Keys (>90 days) ==="
aws iam list-users | jq -r '.Users[].UserName' | while read user; do
aws iam list-access-keys --user-name "$user" | jq -r --arg u "$user" '.AccessKeyMetadata[] | select(.Status=="Active") | "\($u)\t\(.AccessKeyId)\t\(.CreateDate)"'
done | column -t | head -20
Access Advisor (Last Accessed)
#!/bin/bash
ARN="${1:?ARN required (user, role, or group ARN)}"
echo "=== Generating Service Last Accessed Report ==="
JOB_ID=$(aws iam generate-service-last-accessed-details --arn "$ARN" | jq -r '.JobId')
sleep 5
echo "=== Services Last Accessed ==="
aws iam get-service-last-accessed-details --job-id "$JOB_ID" | jq -r '.ServicesLastAccessed | sort_by(.LastAuthenticated) | reverse | .[:20][] | "\(.ServiceName)\t\(.LastAuthenticated // "Never")\t\(.TotalAuthenticatedEntities)"' | column -t
echo ""
echo "=== Unused Services (never accessed) ==="
aws iam get-service-last-accessed-details --job-id "$JOB_ID" | jq -r '.ServicesLastAccessed | map(select(.LastAuthenticated == null)) | length | "Services never used: \(.)"'
Permission Boundary Analysis
#!/bin/bash
echo "=== Roles with Permission Boundaries ==="
aws iam list-roles --max-items 100 | jq -r '.Roles[] | select(.PermissionsBoundary) | "\(.RoleName)\t\(.PermissionsBoundary.PermissionsBoundaryArn)"' | column -t
echo ""
echo "=== Users with Permission Boundaries ==="
aws iam list-users --max-items 100 | jq -r '.Users[] | select(.PermissionsBoundary) | "\(.UserName)\t\(.PermissionsBoundary.PermissionsBoundaryArn)"' | column -t
echo ""
echo "=== Cross-Account Roles ==="
aws iam list-roles --max-items 100 | jq -r '.Roles[] | select(.AssumeRolePolicyDocument.Statement[].Principal.AWS? // "" | test("arn:aws:iam::[0-9]+:")) | "\(.RoleName)\t\(.AssumeRolePolicyDocument.Statement[0].Principal.AWS)"' | column -t 2>/dev/null
Output Format
Present results as a structured report:
Managing Aws Iam Report
═══════════════════════
Resources discovered: [count]
Resource Status Key Metric Issues
──────────────────────────────────────────────
[name] [ok/warn] [value] [findings]
Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]
Target ≤50 lines of output. Use tables for multi-resource comparisons.
Counter-Rationalizations
| Shortcut | Counter | Why |
|---|---|---|
| "I'll skip discovery and check known resources" | Always run Phase 1 discovery first | Resource names change, new resources appear — assumed names cause errors |
| "The user only asked for a quick check" | Follow the full discovery → analysis flow | Quick checks miss critical issues; structured analysis catches silent failures |
| "Default configuration is probably fine" | Audit configuration explicitly | Defaults often leave logging, security, and optimization features disabled |
| "Metrics aren't needed for this" | Always check relevant metrics when available | API/CLI responses show current state; metrics reveal trends and intermittent issues |
| "I don't have access to that" | Try the command and report the actual error | Assumed permission failures prevent useful investigation; actual errors are informative |
Common Pitfalls
- Policy evaluation order: Explicit Deny > SCP > Permission Boundary > Identity Policy > Resource Policy — a single Deny overrides all Allows
- Credential report generation: Takes a few seconds; poll
generate-credential-reportuntil state isCOMPLETE - Access Advisor lag: Service last accessed data can be 4+ hours behind — do not use for real-time decisions
- Trust policy vs permissions: A role's trust policy controls WHO can assume it; attached policies control WHAT it can do — both must be reviewed
- AWS-managed vs customer-managed:
arn:aws:iam::aws:policy/*are AWS-managed and cannot be modified — only audit customer-managed policies for changes - Inline vs managed policies: Inline policies are embedded in users/roles/groups and not reusable — check both types during audits
- SCP interaction: Organization SCPs can restrict permissions even if IAM allows them — check Organizations if permissions seem unexpectedly denied
- Wildcard resources:
"Resource": "*"grants access to ALL resources — flag these during policy reviews