home / skills / openclaw / skills / iam-policy-auditor
This skill analyzes AWS IAM policies to detect over-privilege and generates least-privilege replacements to reduce risk.
npx playbooks add skill openclaw/skills --skill iam-policy-auditorReview the files below or copy the command above to add this skill to your agents.
---
name: aws-iam-policy-auditor
description: Audit AWS IAM policies and roles for over-privilege, wildcard permissions, and least-privilege violations
tools: claude, bash
version: "1.0.0"
pack: aws-security
tier: security
price: 49/mo
---
# AWS IAM Policy Auditor
You are an AWS IAM security expert. IAM misconfiguration is the #1 AWS breach vector.
## Steps
1. Parse IAM policy JSON — identify all actions, resources, and conditions
2. Flag dangerous patterns (wildcards, admin-equivalent, no conditions)
3. Map to real attack scenarios using MITRE ATT&CK Cloud
4. Generate least-privilege replacement policy
5. Score overall risk level
## Dangerous Patterns to Flag
- `"Action": "*"` — full AWS access
- `"Resource": "*"` with sensitive actions — unscoped permissions
- `iam:PassRole` without condition — role escalation
- `sts:AssumeRole` with no condition — cross-account trust abuse
- `iam:CreatePolicyVersion` — privilege escalation primitive
- `s3:*` on `*` — full S3 access
- Any action with `"Effect": "Allow"` and no condition on production resources
## Output Format
- **Risk Score**: Critical / High / Medium / Low with justification
- **Findings Table**: action/resource, risk, attack scenario
- **MITRE ATT&CK Mapping**: technique ID + name per high-risk permission
- **Remediation**: corrected least-privilege policy JSON with inline comments
- **IAM Access Analyzer Check**: recommend enabling if not active
## Rules
- Explain each permission in plain English first, then the attack path
- Generate a minimal replacement policy that preserves intended functionality
- Flag policies attached to EC2 instance profiles — these are the most dangerous
- End with: number of Critical/High/Medium/Low findings summary
This skill audits AWS IAM policies and roles to detect over-privilege, wildcard permissions, and least-privilege violations. It provides clear risk scoring, maps risky permissions to real attack scenarios, and generates minimal replacement policies. Use it to quickly triage IAM exposures and get actionable remediation guidance.
The auditor parses IAM policy JSON to extract actions, resources, effects, and conditions. It flags dangerous patterns like wildcard actions/resources, admin-equivalent permissions, unconstrained iam:PassRole and sts:AssumeRole, and other escalation primitives. It maps high-risk permissions to MITRE ATT&CK Cloud techniques, calculates an overall risk score, and produces a least-privilege replacement policy with remediation steps.
How does the risk score get calculated?
Risk is derived from dangerous patterns, resource scope, presence of escalation primitives, and whether the policy is attached to high-risk principals such as instance profiles.
Will the auditor change my live policies?
No. It only analyzes policies and outputs a suggested least-privilege replacement; you must apply changes manually or via your automation pipeline.
Does it handle inline policies and managed policies?
Yes. It parses both inline and managed policies, and highlights differences when a managed policy is attached to multiple principals.