Claude Skill

Audit AWS IAM policies for risky permissions with Cloudsplaining

Use Cloudsplaining when an agent needs to flag privilege-escalation paths and overbroad IAM permissions before an AWS policy change reaches production.

LLM Mart · 0 points · 0 0 0

Virus-scanned Reviewed automatically before listing.

Full trust report

Download agentskillexchange-skills-skills_audit-aws-iam-policies-for-risky-permissions-with-cloudsplaining-07beb56.zip · 1 KB

agentskillexchange/skills 45 57 forks MIT Updated 12h ago

Part of agentskillexchange/skills — 249 skills

Install

skills CLI

npx skills add https://github.com/agentskillexchange/skills/tree/main/skills/audit-aws-iam-policies-for-risky-permissions-with-cloudsplaining

Claude Code

claude plugin marketplace add https://llmmart.ai/marketplace.json && claude plugin install agentskillexchange-skills@llmmart

Git git clone https://github.com/agentskillexchange/skills.git

The skills CLI installs just this skill, for any of its supported agents. Claude Code installs the whole agentskillexchange/skills collection as a plugin from our marketplace. Git is the plain clone.

Skill manifest

Audit AWS IAM policies for risky permissions with Cloudsplaining

Use Cloudsplaining when an agent needs to flag privilege-escalation paths and overbroad IAM permissions before an AWS policy change reaches production.

Prerequisites

Python 3, AWS IAM policy JSON or account data, and Cloudsplaining.

Installation

Use the upstream install or setup path that matches your environment:

brew tap salesforce/cloudsplaining https://github.com/salesforce/cloudsplaining
brew install cloudsplaining

Requirements and caveats from upstream:

You must have the privileges to run iam:GetAccountAuthorizationDetails. The arn:aws:iam::aws:policy/SecurityAudit policy i...
default-iam-results.json: This contains the raw JSON output of the report. You can use this data file for operating on the scan results for various purposes. For example, you could write a Python script that parses th...

Basic usage or getting-started notes:

Example report
Cloudsplaining also identifies IAM Roles that can be assumed by AWS Compute Services (such as EC2, ECS, EKS, or Lambda), as they can present greater risk than user-defined roles - especially if the AWS Compute service...
You can also specify a custom exclusions file to filter out results that are False Positives for various reasons. For example, User Policies are permissive by design, whereas System roles are generally more restrictiv...
Source: https://github.com/salesforce/cloudsplaining
Extracted from upstream docs: https://raw.githubusercontent.com/salesforce/cloudsplaining/HEAD/README.md

Documentation

https://cloudsplaining.readthedocs.io/en/latest/

Source

Agent Skill Exchange

Files (skills)

SKILL.md 2.6 KB

---
name: "Audit AWS IAM policies for risky permissions with Cloudsplaining"
slug: "audit-aws-iam-policies-for-risky-permissions-with-cloudsplaining"
description: "Use Cloudsplaining when an agent needs to flag privilege-escalation paths and overbroad IAM permissions before an AWS policy change reaches production."
github_stars: 2202
verification: "security_reviewed"
source: "https://github.com/salesforce/cloudsplaining"
author: "Salesforce"
publisher_type: "organization"
category: "Security & Verification"
framework: "Multi-Framework"
tool_ecosystem:
  github_repo: "salesforce/cloudsplaining"
  github_stars: 2202
---

# Audit AWS IAM policies for risky permissions with Cloudsplaining

Use Cloudsplaining when an agent needs to flag privilege-escalation paths and overbroad IAM permissions before an AWS policy change reaches production.

## Prerequisites

Python 3, AWS IAM policy JSON or account data, and Cloudsplaining.

## Installation

Use the upstream install or setup path that matches your environment:
- brew tap salesforce/cloudsplaining https://github.com/salesforce/cloudsplaining
- brew install cloudsplaining

Requirements and caveats from upstream:
- [![Python Version](https://img.shields.io/pypi/pyversions/cloudsplaining)](#)
- You must have the privileges to run [iam:GetAccountAuthorizationDetails](https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountAuthorizationDetails.html). The arn:aws:iam::aws:policy/SecurityAudit policy i...
- default-iam-results.json: This contains the raw JSON output of the report. You can use this data file for operating on the scan results for various purposes. For example, you could write a Python script that parses th...

Basic usage or getting-started notes:
- [Example report](https://opensource.salesforce.com/cloudsplaining/)
- Cloudsplaining also identifies IAM Roles that can be assumed by AWS Compute Services (such as EC2, ECS, EKS, or Lambda), as they can present greater risk than user-defined roles - especially if the AWS Compute service...
- You can also specify a custom exclusions file to filter out results that are False Positives for various reasons. For example, User Policies are permissive by design, whereas System roles are generally more restrictiv...

- Source: https://github.com/salesforce/cloudsplaining
- Extracted from upstream docs: https://raw.githubusercontent.com/salesforce/cloudsplaining/HEAD/README.md

## Documentation

- https://cloudsplaining.readthedocs.io/en/latest/

## Source

- [Agent Skill Exchange](https://agentskillexchange.com/skills/audit-aws-iam-policies-for-risky-permissions-with-cloudsplaining/)