aws iam accessdenied triage

AWS IAM failures are notoriously opaque, often hiding the specific policy layer responsible for a block. This skill provides a structured diagnostic workflow to triage AccessDenied, UnauthorizedOperation, and AssumeRole failures without requiring live account access. It helps you move from a vague error string to a prioritized list of likely causes across identity policies, SCPs, resource policies, and boundaries.

What it does

• Analyze error strings to extract the principal, action, resource, and specific denial reason.
• Identify policy layers by ranking candidate causes across IAM, SCP, VPC endpoints, and resource-based policies.
• Diagnose AssumeRole failures by evaluating trust relationships, OIDC claims, and session conditions.
• Compare environments to find why a request succeeds locally but fails in CI/CD or production workloads.
• Generate least-privilege candidates for missing permissions based on the specific evidence provided.

How it works

1. Supply a sanitized AWS error message and optional context like the calling identity or relevant policy snippets.
2. The skill parses the literal denial to determine if it is an explicit Deny or an implicit failure to Allow.
3. It maps the error to the specific AWS operation type, such as sts:AssumeRole or a service-specific action.
4. It delivers a ranked report with evidence-backed hypotheses and safe, read-only verification steps.

Frameworks & tools

Works with any AWS interface producing authorization errors, including AWS CLI, SDKs, Terraform, CloudFormation, and GitHub Actions.

Why this beats prompting it yourself

Generic prompts often guess at a single IAM policy, ignoring complex layers like SCPs or Permissions Boundaries. This skill enforces a systematic triage that accounts for the AWS policy evaluation logic and prevents risky suggestions like AdministratorAccess.

Use cases

• Debugging GitHub Actions runners that fail to assume a role via OIDC.
• Identifying which SCP in an AWS Organization is blocking a specific service action.
• Troubleshooting Cross-Account access failures for S3 buckets or KMS keys.

Known limitations

This tool is offline and read-only. It cannot connect to your AWS account, query APIs, or verify if a policy change actually works. Requires users to redact sensitive identifiers manually.