securing-aws-iam-permissions

name	securing-aws-iam-permissions
description	Use when this skill guides practitioners through hardening AWS Identity and Access Management configurations to enforce least privilege access across cloud accounts. It covers IAM policy scoping, permission boundaries, Access Analyzer integration, and credential rotation strategies to reduce the blast radius of compromised identities.
domain	cybersecurity
tags	["aws-iam","least-privilege","permission-boundaries","access-analyzer","cloud-identity"]
subdomain	cloud-security
version	1.0.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]

Securing Aws Iam Permissions

Overview

Cybersecurity skill for securing aws iam permissions. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "securing aws iam permissions"

• "This skill guides practitioners through hardening AWS Identity and Access Manage"

• When onboarding new AWS accounts or workloads that require scoped IAM policies

• When IAM Access Analyzer reports overly permissive policies or unused permissions

• When preparing for a compliance audit requiring least privilege evidence (SOC 2, PCI-DSS)

• When migrating from long-lived access keys to short-lived role-based credentials

• When remediating findings from AWS Security Hub related to IAM misconfigurations

Do not use for Azure AD or Google Cloud IAM configurations, application-level authorization logic, or federated identity provider setup (see managing-cloud-identity-with-okta).

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• AWS account with administrative access or IAM:FullAccess permissions
• AWS CLI v2 installed and configured with named profiles
• AWS CloudTrail enabled for at least 90 days of API activity history
• Familiarity with JSON-based IAM policy syntax and ARN resource notation

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

def extract_iocs(text: str) -> dict:
    return {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}