# Iam Review

> Review IAM permissions for least privilege compliance (AWS)

- Skill: `filipemotta/iam-review` (Agent Skill)
- Install (CLI): `npx skillmds@latest add filipemotta/iam-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/filipemotta/iam-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: filipemotta (https://skillmd.com/u/filipemotta)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/filipemotta/iam-review

---


# /iam-review

## Data Collection
1. **List IAM Roles and Policies**:
   - `aws iam list-roles` - All roles in the account
   - `aws iam list-policies --scope Local` - Custom policies
   - For each role: `aws iam list-attached-role-policies`
   - For each role: `aws iam list-role-policies` (inline)

2. **Analyze Inline vs Managed Policies**:
   - Flag inline policies (harder to audit and reuse)
   - Check managed policy versions and drift

3. **Check Permissions Boundaries**:
   - `aws iam get-role` - PermissionsBoundary field
   - Flag roles WITHOUT permissions boundaries

4. **Cross-Account Access**:
   - Check trust policies for external account IDs
   - Verify `sts:ExternalId` condition exists
   - Flag overly broad trust (`Principal: "*"`)

5. **Service-Linked Roles**:
   - Identify auto-created service roles
   - Verify they match active services

## Analysis Checklist
- [ ] **Wildcard Actions**: Policies with `s3:*`, `ec2:*`, `iam:*`
- [ ] **Wildcard Resources**: Policies with `Resource: "*"`
- [ ] **Missing Conditions**: No IP restriction, no MFA requirement
- [ ] **Admin Access**: Roles with `AdministratorAccess` policy
- [ ] **Access Keys**: IAM users with access keys (prefer roles)
- [ ] **Unused Permissions**: Last accessed >90 days (via Access Advisor)
- [ ] **Cross-Account Trust**: Verify all trusted accounts are known
- [ ] **Assume Role Chains**: Role A assumes B assumes C (excessive)

## Output
1. **Risk Score**: X/10 (10 = most risky)
2. **Critical**: Admin access, wildcard permissions, public trust
3. **Warnings**: Unused permissions, missing conditions, inline policies
4. **Recommendations**: Specific least-privilege policy suggestions
5. **Policy Suggestions**: JSON of corrected IAM policies

For each finding, provide the **current** policy snippet and the **recommended** replacement.