# Least-privilege IAM review (/cloud--iam-least-privilege)

/cloud--iam-least-privilege is a Claude Code skill in the Code section. Audits IAM policies and writes least-privilege replacements as reviewable code changes, without applying anything itself.

- Web version: https://skills.sgomez.dev/en/s/cloud--iam-least-privilege
- Section: [Code](https://skills.sgomez.dev/en/code.md)
- Author: Santiago Gómez de la Torre
- License: MIT
- Source: https://github.com/sgomez-dev/claude-skills/blob/main/skills/cloud/iam-least-privilege.md
- Updated 10 Jul 2026

## How to ask for it

- `/cloud--iam-least-privilege audit the IAM policies on my AWS account`
- `/cloud--iam-least-privilege review my service roles and suggest minimal permissions`
- `/cloud--iam-least-privilege find over-privileged access in my GCP project`

## Install

macOS · Linux:

```
curl -fsSL https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.sh | bash
```

Windows:

```
irm https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.ps1 | iex
```

Claude Code plugin:

```
/plugin marketplace add sgomez-dev/claude-skills
/plugin install cloud-skills@claude-skills-collection
```

## Permissions

- Reads: `**/*`
- Writes: `infra/**`, `docs/iam-audit*.md`, `*.md`, `**/*.tf`, `**/*.json`, `**/*.yml`, `**/*.yaml`
- Runs: `aws iam list-*`, `aws iam get-*`, `aws sts get-caller-identity`, `aws accessanalyzer *`, `gcloud iam * list *`, `gcloud iam * describe *`, `gcloud projects get-iam-policy *`, `az role assignment list *`, `az role definition list *`
- Network: No
- Destructive: No

## Author's description

Audit IAM policies and generate least-privilege replacements you review and apply

- [How we review this](https://skills.sgomez.dev/en/methodology.md)