More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    AWS IAM Least Privilege Generator

    1

    Analyze large local CloudTrail datasets for a role or user, derive observed IAM actions, flag dependency and PassRole gaps, and generate a review-ready least-privilege policy candidate with evidence.

    $15

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    AWS IAM Least Privilege Generator

    AWS IAM Least Privilege Generator

    Example session with this skill installed

    Analyze the CloudTrail logs in ./cloudtrail-2026/ for IAM role payments-worker-prod.

    Use activity from 2026-06-01 through 2026-08-31.

    I want an observed-use IAM least-privilege policy candidate.

    Requirements

    • process JSON and JSON.GZ logs locally;
    • filter assumed-role sessions back to payments-worker-prod;
    • map only actions that can be supported from the logs;
    • do not use service:* or Action:* wildcards;
    • do not automatically add dependency permissions;
    • flag iam:PassRole separately;
    • flag whether CloudTrail data-event coverage may be incomplete;
    • preserve evidence showing which events support each action;
    • extract resource ARNs only as review hints;
    • do not deploy or attach the generated policy.

    Generate the policy JSON, observed action list, evidence CSV, dependency review list, resource hints, unmapped events, and review queue.

    • Read your context and instructions
    • Compiled the aws iam least

    IAM rightsizing analysis complete

    Target principal: payments-worker-prod
    CloudTrail files scanned: 18,442
    Events read: 6,208,117
    Events matched to role: 428,391
    Unique mapped IAM actions: 37
    Unmapped events: 4
    Dependency permissions requiring review: 6
    Resource ARN hints: 112
    Policy deployment performed: No

    Most frequently observed actions

    ActionCount
    dynamodb:GetItem182,441
    dynamodb:UpdateItem96,382
    kms:Decrypt73,911
    s3:GetObject34,772
    sqs:ReceiveMessage22,119

    Candidate policy excerpt

    {
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ObservedDynamodbActions",
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:UpdateItem"
      ],
      "Resource": "*"
    }
  ]
}

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    AWS teams often start with broad IAM permissions because it keeps development moving. Months later, those policies may still contain far more access than the workload actually uses.

    Manually reading large CloudTrail exports and converting activity into a defensible IAM policy can take days.

    What it does

    AWS IAM Least Privilege Generator processes local CloudTrail JSON/JSON.GZ logs and builds an observed-use IAM policy candidate for a specified role or user.

    • Streams large CloudTrail log collections locally
    • Filters events to a target IAM role or user
    • Maps observed AWS API operations to IAM actions
    • Counts first/last use and event frequency
    • Preserves event-level evidence for every mapped permission
    • Adds review-only dependency hints for supporting permissions
    • Separately flags iam:PassRole risk
    • Flags missing data-event coverage
    • Extracts resource ARN hints without pretending they are safe policy scopes
    • Produces a policy candidate, review queue, and audit artifacts

    Why this beats prompting it yourself

    A normal chatbot cannot reliably ingest gigabytes of CloudTrail logs into context.

    This skill keeps the heavy extraction and aggregation in local Python scripts, while the agent focuses on mapping uncertainty, dependency review, and policy analysis.

    It does not replace AWS Access Analyzer

    AWS already provides IAM Access Analyzer policy generation from CloudTrail activity.

    This skill is differentiated by local processing, custom historical exports, explicit event evidence, dependency review, resource-hint reporting, and file-based security review outputs.

    Safe by design

    The generated policy is an observed-use candidate—not an automatic production replacement.

    The skill never deploys, attaches, detaches, or deletes IAM policies automatically.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for LLM Ops.

    Requires local JSON/JSON.GZ logs. No auto-deployment. Data-plane actions (S3/Lambda) require specific trail logging. Does not automatically infer iam:PassRole or rare disaster recovery paths.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 1 month ago

    Software
    Python

    Permissions

    Terminal / Shell
    Listed1 month ago
    Updated20 days ago

    What's inside

    Frequently Asked Questions

    Unlike standard AWS tools, this skill analyzes local logs to map real-world activity to specific IAM permissions, providing an evidence-based audit trail and identifying hidden dependencies that logs alone might miss.

    The skill is a Python-based utility compatible with most AI agent environments and local development setups that support file system access for processing log data.

    No, for security and privacy, this skill processes logs locally; you only need to provide the path to your exported CloudTrail JSON files and the specific IAM ARN you wish to analyze.

    You will receive the core policy generation logic, the proprietary mapping library that translates CloudTrail events to IAM actions, and documentation for the review queue system.

    The tool excels at management events; however, data-plane actions (like S3 GetObject or DynamoDB queries) are only included if you have explicitly enabled Data Events in your CloudTrail configuration.

    New in LLM Ops