How Wix scaled AI-native work to 5,000 employees with Willow
Read More
Skills

IAM Policy Analyzer

verified
Last updatedUpdated Jul 12, 2026

What this skill does

Reviews IAM policies across cloud providers to identify over-permissive access, unused roles, cross-account trust issues, and privilege escalation paths. Generates a risk-scored findings report with specific remediation recommendations for each policy violation.

Example

InputPROMPT

We need to review IAM policies for our 50-person engineering org on AWS. We have 200+ IAM roles, a mix of human users, service accounts, and CI/CD pipelines. Concern: possible over-permissive policies from rapid onboarding. We use Organization SCPs and need cross-account trust review.

OutputOUTPUT
IAM Policy Findings Report — [Account ID] | Generated: 2026-02-20 OVER-PERMISSIVE POLICIES (Risk: High) | Role/Policy | Violation | Risk | Remediation | |-----------------------|-----------------------------------|------|-------------------------------| | prod-deploy-role | s3:* on all buckets | 9.2 | Scope to specific bucket ARNs | | dev-admin-assume | iam:* attached to assume role | 8.8 | Remove iam:*; use least priv | | lambda-exec-* | dynamodb:GetItem resource: * | 6.5 | Restrict to required table | UNUSED ROLES (Last used >90 days) | Role Name | Last Used | Action | |-----------------------|-------------|----------| | legacy-migration-2019 | 2024-03-12 | Decommission | | temp-intern-role-1 | 2025-08-01 | Review & remove | | ... 12 more | | | PRIVILEGE ESCALATION PATHS | Path | Steps | Severity | |-----------------------|-------|----------| | dev-user → admin | 2 (AssumeRole + PassRole) | Critical | | cicd-role → root | 3 (CreateUser + AttachPolicy) | High | Total findings: 28 | Critical: 2 | High: 8 | Medium: 12 | Low: 6

Required Tools

AWSAWS
GitHubGitHub

Compatible Agents

ClaudeClaude
CursorCursor
WindsurfWindsurf
ChatGPTChatGPT
GitHub CopilotGitHub Copilot
Any MCP-compatible agentAny MCP-compatible agent
Integration

Add to your agent

Download Skill

Or install via CLI:

$ npx skills add webrix-ai/agent-skills --skill iam-policy-analyzer

Enterprise

Deploy Org-wide

SSO readyProvision to teams via RBAC
SecurityIdentity-aware execution
ComplianceSigned & verified skills
AnalyticsFull audit trail
GovernanceAuto-bundled with required MCP servers
Use withwillow
Get started

Free for up to 5 users

Your agents are already in the wild.

Give them a Basecamp. Go from AI chaos to AI work, in minutes.