More screenshots
Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
OpenClaw+21 moreClaude CodeCursorCodex CLIMuseOpenClaw
Manus
Grok
Grok Bot+18 agentsAWS IAM Least Privilege Generator
Analyze large local CloudTrail datasets for a role or user, derive observed IAM actions, flag dependency and PassRole gaps, and generate a review-ready least-privilege policy candidate with evidence.
$5
AWS IAM Least Privilege Generator
Example session with this skill installed
Analyze the CloudTrail logs in ./cloudtrail-2026/ for IAM role payments-worker-prod.
Use activity from 2026-06-01 through 2026-08-31.
I want an observed-use IAM least-privilege policy candidate.
Requirements
- process JSON and JSON.GZ logs locally;
- filter assumed-role sessions back to payments-worker-prod;
- map only actions that can be supported from the logs;
- do not use service:* or Action:* wildcards;
- do not automatically add dependency permissions;
- flag iam:PassRole separately;
- flag whether CloudTrail data-event coverage may be incomplete;
- preserve evidence showing which events support each action;
- extract resource ARNs only as review hints;
- do not deploy or attach the generated policy.
Generate the policy JSON, observed action list, evidence CSV, dependency review list, resource hints, unmapped events, and review queue.
- Read your context and instructions
- Compiled the aws iam least
IAM rightsizing analysis complete
Target principal: payments-worker-prod
CloudTrail files scanned: 18,442
Events read: 6,208,117
Events matched to role: 428,391
Unique mapped IAM actions: 37
Unmapped events: 4
Dependency permissions requiring review: 6
Resource ARN hints: 112
Policy deployment performed: No
Most frequently observed actions
| Action | Count |
|---|---|
| dynamodb:GetItem | 182,441 |
| dynamodb:UpdateItem | 96,382 |
| kms:Decrypt | 73,911 |
| s3:GetObject | 34,772 |
| sqs:ReceiveMessage | 22,119 |
Candidate policy excerpt
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "ObservedDynamodbActions",
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:UpdateItem"
],
"Resource": "*"
}
]
}
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
The problem
AWS teams often start with broad IAM permissions because it keeps development moving. Months later, those policies may still contain far more access than the workload actually uses.
Manually reading large CloudTrail exports and converting activity into a defensible IAM policy can take days.
What it does
AWS IAM Least Privilege Generator processes local CloudTrail JSON/JSON.GZ logs and builds an observed-use IAM policy candidate for a specified role or user.
- Streams large CloudTrail log collections locally
- Filters events to a target IAM role or user
- Maps observed AWS API operations to IAM actions
- Counts first/last use and event frequency
- Preserves event-level evidence for every mapped permission
- Adds review-only dependency hints for supporting permissions
- Separately flags iam:PassRole risk
- Flags missing data-event coverage
- Extracts resource ARN hints without pretending they are safe policy scopes
- Produces a policy candidate, review queue, and audit artifacts
Why this beats prompting it yourself
A normal chatbot cannot reliably ingest gigabytes of CloudTrail logs into context.
This skill keeps the heavy extraction and aggregation in local Python scripts, while the agent focuses on mapping uncertainty, dependency review, and policy analysis.
It does not replace AWS Access Analyzer
AWS already provides IAM Access Analyzer policy generation from CloudTrail activity.
This skill is differentiated by local processing, custom historical exports, explicit event evidence, dependency review, resource-hint reporting, and file-based security review outputs.
Safe by design
The generated policy is an observed-use candidate—not an automatic production replacement.
The skill never deploys, attaches, detaches, or deletes IAM policies automatically.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 2 days ago
- Passed all security checks, Safe to install
Needs access to
Amazon