Delegate the audit with scope $1 (default: full) to the iam-auditor
subagent.
- Confirm the session uses read-only credentials. Credentials with write access? Stop and warn: an audit never runs with the power to change things.
- At the end, the report goes to
docs/audits/YYYY-MM-DD.mdand new/recurring findings todocs/aws-audit-log.md. - For each CRITICAL, open (or propose) the correction PR via IaC. Never fix directly in the account... even with credentials that would allow it.
Requires: the iam-auditor subagent installed in
.claude/agents/iam-auditor.md (available in this repository under
subagents/).