{"slug":"iam-policy-review","name":"IAM Policy Review","version":"1.0.0","updated_at":"2026-10-19T07:15:21.575Z","use_when":"Reviews ONE AWS IAM policy (an identity policy, or a bucket policy) written as JSON for the five grants that hand out far more than a job needs, and lists only those, one line each with a fixed code, the statement, why it is dangerous and the fix - or exactly No findings. It catches every action on every resource or a whole service on every resource, iam:PassRole on any role, Allow combined with NotAction, a public principal with no condition, and actions that let a holder raise their own rights such as creating a policy version or attaching a policy. It leaves out the safe look-alikes, such as a public principal narrowed to an organization, read-only access to one bucket, and a Deny with NotAction. Use to review a policy before attaching it, to audit a role, or to check a bucket policy for public access.","not_for":"Trust policies, permission boundaries, organization policies, other cloud providers and checking that resource names exist. It reads one pasted policy and judges only what is written in it.","languages":["en"],"tags":["aws","iam","least-privilege","bucket-policy","security","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["IAM policy","iam:PassRole","public principal","bucket policy"],"faq":[{"q":"Open principal in a resource policy: always a finding?","a":"No. A principal of star that is narrowed by an organization-id condition is left alone, and so is any statement whose effect is Deny. A principal of star with no condition that limits who may call is reported, even when the files may be meant for the public."},{"q":"Is read-only access to one bucket a finding?","a":"No. Reading objects of one named bucket is the narrow grant the policy should look like. Whole-service wildcards on every resource, and passing any role to a service, are reported."},{"q":"Where does the list of escalation actions come from?","a":"It belongs to this skill alone, since the AWS pages give no list of dangerous actions, and the skill states that openly. It covers writing a new policy version and attaching or putting a policy while the resource is a star."},{"q":"Which policies went into the test?","a":"Claude Haiku and Claude Sonnet each got three documents to review once: a deploy role holding a registry wildcard, a pass-role grant and a policy-version grant; a bucket policy with an open principal and an inverted allow for an ETL role; and a clean reader policy that carries a Deny with an inverted action list. Judged manually, both models matched every expectation."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Sid\": \"PublicAssets\",\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": \"s3:GetObject\",\n      \"Resource\": \"arn:aws:s3:::acme-shared-data/assets/*\"\n    },\n    {\n      \"Sid\": \"OrgRead\",\n      \"Effect\": \"Allow\",\n      \"Principal\": \"*\",\n      \"Action\": [\n        \"s3:GetObject\",\n        \"s3:ListBucket\"\n      ],…","output_excerpt":"NOTACTION-ALLOW — statement \"EtlRole\", NotAction \"s3:DeleteBucket\" — allows every action except DeleteBucket on the bucket and its objects, including PutBucketPolicy, PutObject and DeleteObject, so the role gets far more than the listed exception suggests — replace NotAction with an Action list of only the S3 actions the ETL job needs…"}],"page_url":"https://aiskills402.com/skills/iam-policy-review","markdown_url":"https://aiskills402.com/skills/iam-policy-review.md","image_url":"https://cdn.aiskills402.com/og/skills/iam-policy-review/8ebc5750.png","related_url":"https://api.aiskills402.com/v1/skills/iam-policy-review/related","purchases_count":null,"tested":{"date":"2026-10-19","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the deploy role it gave the registry wildcard, the pass-role grant and the policy-version grant, and left out the read-only bucket and the scoped log group. On the bucket policy it gave the open principal and the NotAction allow and left out the organization-limited principal, though in the opposite order from the list. On the clean policy it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on all 3 cases, read by hand. It matched the strong model on the deploy role and on the bucket policy, adding a sensible note that the public statement may be intended. It put a blank line between the two findings of the bucket policy, which the check accepts, and answered exactly No findings on the clean policy."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6374,"sha256":"b6843a02f76ac9ca8141496151dd19ae0e8d71b0366b1cd601fcc79ab49d0c1e","outline":["What the AWS documentation says, as published on 19 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/iam-policy-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"AWS IAM Policy Security Review","seo_description":"Reviews one AWS policy for wildcard grants, iam:PassRole on any role, inverted allows, open principals and self-escalation. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-19","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-19\n\nFirst release, written in the light-test batch of 19 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill text after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n"}]}