菜单
Use when reviewing an AWS IAM policy, role, or trust document, checking for over-broad permissions, privilege escalation paths, or "/iam-review-aws". Audits a policy JSON for least-privilege violations.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | aws-iam-policy-review |
| description | Use when reviewing an AWS IAM policy, role, or trust document, checking for over-broad permissions, privilege escalation paths, or "/iam-review-aws". Audits a policy JSON for least-privilege violations. |
| tools | ["cursor","claude","copilot"] |
aws iam get-role-policy … output).Confirm scope. Identify policy type:
sts:AssumeRole)Parse every Statement. For each, capture Effect, Action, NotAction, Resource, NotResource, Principal, Condition.
Flag risky patterns:
| Pattern | Why it's risky |
|---|---|
Action: "*" on Resource: "*" | full admin |
iam:PassRole with Resource: "*" | privilege escalation |
iam:CreatePolicyVersion, iam:SetDefaultPolicyVersion, iam:Attach*Policy | self-escalation |
sts:AssumeRole cross-account without sts:ExternalId condition | confused deputy |
kms:Decrypt / kms:GenerateDataKey on Resource: "*" | broad data access |
s3:* without bucket scope or Condition | data risk |
NotAction / NotResource in an Allow statement | usually unintended grant |
Effect: Allow to Principal: "*" (resource policy) | public access |
Missing aws:SourceAccount / aws:SourceArn on service principals | confused-deputy |
Check conditions for guardrails: aws:PrincipalOrgID, aws:SourceVpce, aws:SecureTransport, aws:MultiFactorAuthPresent, IP allow-lists, tag-based scoping (aws:ResourceTag/*).
Suggest a least-privilege rewrite as a JSON diff. Replace wildcards with the smallest action set that covers the documented use case. Add Condition blocks where missing.
Report:
## AWS IAM Policy Review — <policy/role name>
**Type:** identity | resource | trust | SCP
**Verdict:** safe | needs-changes | high-risk
### High-risk findings
- `iam:PassRole` on `*` — allows attaching any role to compute. Limit to `arn:aws:iam::<acct>:role/app-*`.
### Medium-risk findings
- No `aws:SecureTransport` condition on `s3:GetObject`.
### Suggested rewrite
```diff
- "Action": "s3:*",
- "Resource": "*"
+ "Action": ["s3:GetObject", "s3:PutObject"],
+ "Resource": "arn:aws:s3:::my-bucket/*",
+ "Condition": { "Bool": { "aws:SecureTransport": "true" } }
aws iam simulate-principal-policy on critical actions.aws iam put-*, attach-*, create-policy-version, or update-assume-role-policy — review only.Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.