aws-iam
aws iam
What it does
- AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization.
- ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1. ?region= forces specific region.
- GetSessionToken restrictions: (1) No IAM APIs unless MFA included (2) No STS except AssumeRole and GetCallerIdentity.
- Cross-account AssumeRole to opt-in region: TARGET account must enable region, not calling account.
- Role chaining: max 1-hour session.
- Suspended/closed accounts CANNOT be removed until permanently closed (~90 days). Remove FIRST, then close.
- Policy management delegation: use PutResourcePolicy, NOT register-delegated-administrator.
Requirements & configuration
- MFA resync-only policy NotAction needs exactly: iam:ListMFADevices, iam:ListVirtualMFADevices, iam:ResyncMFADevice.
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
aws-iam FAQ
What does the aws-iam skill do?
> Verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and least-privilege policy generation. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks for absent keys), bucket policy deny patterns (VPC endpoint restrictions, org path conditions), resource-based policy confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, VPC Flow Logs, Firehose, DataSync, S3 replication, Lambda, Step Functions, ECS, etc.) including trust policies with aws:SourceAccount/aws:SourceArn conditions. Applies when creating or configuring IAM roles, writing IAM or bucket policies, working with STS, Organizations, condition operators, or any task requiring an IAM service role or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC. AcceptHandshake/DeclineHandshake logged in ACTING account ONLY, not management account. Organization trail required for centralization. ConsoleLogin region varies by endpoint/cookies, NOT always us-east-1. ?region= forces specific region.
What does aws-iam require?
MFA resync-only policy NotAction needs exactly: iam:ListMFADevices, iam:ListVirtualMFADevices, iam:ResyncMFADevice.
How do I install aws-iam?
Run: npx -y skills add https://github.com/aws/agent-toolkit-for-aws --skill aws-iam --agent claude-code — the source lives at github.com/aws/agent-toolkit-for-aws.
Maintain aws-iam?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[aws-iam on getagentictools](https://getagentictools.com/skills/aws-agent-toolkit-for-aws-aws-iam?ref=badge) npx agentictools info skills/aws-agent-toolkit-for-aws-aws-iam The second line is the CLI lookup for this page — handy in READMEs and docs.
