Write least-privilege AWS IAM: scope actions and resource ARNs to exactly what's needed, attach to roles (not users/keys), prefer federation (IRSA/OIDC) and Identity Center, and cap with permission boundaries + SCPs.
Installs into .claude/skills of the current project.
Are you the author of Aws Least Privilege Iam?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/mcorbett51090-aws-least-privilege-iam)
---
name: aws-least-privilege-iam
description: "Write least-privilege AWS IAM: scope actions and resource ARNs to exactly what's needed, attach to roles (not users/keys), prefer federation (IRSA/OIDC) and Identity Center, and cap with permission boundaries + SCPs."
---
# AWS Least-Privilege IAM
## Roles + federation, not keys
Instance/task roles, **IRSA** (EKS), **OIDC** (CI). Humans -> **Identity Center (SSO)**. A long-lived access key is the top breach vector.
## Minimum, then prove it
Scope `Action` + `Resource` ARNs tightly. Use Access Analyzer + last-used to remove unused grants. `*`/`*` is a finding.
## Ceilings
**Permission boundaries** (per-role cap) + **SCPs** (org cap) = defense in depth.
## Route the verdict
Produce the policy + residual risk; `security-engineering`/`security-reviewer` clears sensitive grants.
