New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

AWS Cloudformation Iam

by giuseppe-trisciuoglio in giuseppe-trisciuoglio/developer-kit

Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships.

MITAuto-check: notesDevOps & Cloud

Install AWS Cloudformation Iam

skills CLI
$ npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-iam -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install giuseppe-trisciuoglio/developer-kit aws-cloudformation-iam --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/giuseppe-trisciuoglio/developer-kit.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam .claude/skills/aws-cloudformation-iam && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
aws-cloudformation-iam
GitHub stars
357
Token cost
~1.5k tokens
SKILL.md length
503 words
Files
3 (incl. references)
Skills in repo
115
Repo updated
First seen
Licence
MIT

At a glance

Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships.

  • Works in 5 steps: Define the trust boundary first → Grant the minimum permission set → Apply permission boundaries for… → …
  • Modeling least-privilege access
  • SKILL.md covers Overview, When to Use, Instructions and Examples, plus 4 more sections
  • Calls aws

What it does

AWS Cloudformation Iam is an agent skill from giuseppe-trisciuoglio/developer-kit. Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use when modeling least-privilege access, cross-account assumptions, service roles, or reusable IAM stacks that other CloudFormation templates consume.

Its SKILL.md is about 1.5k tokens, which your agent loads only when the skill is triggered. The skill folder holds 3 other files, including reference files (for example `references/examples.md` and `references/reference.md`).

It sits in DevOps & Cloud, covering Infrastructure as code. It works with AWS CloudFormation. The repository describes itself as: Modular plugin marketplace for Claude Code and agentic CLIs, with validated, spec-driven skills, agents, commands, and workflows for Java, TypeScript, Python, PHP, AWS, and AI. The licence is MIT.

When your agent uses it

  • Modeling least-privilege access
  • Cross-account assumptions
  • Reusable IAM stacks that other CloudFormation templates consume

Example prompts

  • “Use the aws-cloudformation-iam skill to provide AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and…”
  • “/aws-cloudformation-iam”

Requirements

  • Pre-approved tools (allowed-tools): Read, Write, Bash

Workflow steps

5 steps, taken from the step headings in SKILL.md.

  1. Define the trust boundary first
  2. Grant the minimum permission set
  3. Apply permission boundaries for delegated role creation
  4. Model cross-account access
  5. Validate the template and policy behavior

What it can do on your machine

Read from SKILL.md and the folder at commit fe73fb3. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves these tools, so the agent can use them without asking each time:

    • Read
    • Write
    • Bash

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • aws

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use aws, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

AWS Cloudformation Iam loads about 1.5k tokens when it runs, and up to ~24k if it reads all its reference files. Until then it costs about 76 tokens; SKILL.md has 503 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~76
When it runs · the whole SKILL.md, loaded when a task matches
~1.5k
With references · SKILL.md plus every file in references/, read only if the agent opens them
~24k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NotePre-approves every shell command (allowed-tools: Bash)SKILL.md
    allowed-tools: Read, Write, Bash

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from giuseppe-trisciuoglio/developer-kit at commit fe73fb3, republished under its MIT licence (© giuseppe-trisciuoglio). 503 words, ~1,468 tokens.

Download SKILL.mdSave it as .claude/skills/aws-cloudformation-iam/SKILL.md (or your agent's skills folder). This skill also uses 2 other files; get the full folder from GitHub.
name
aws-cloudformation-iam
description
Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. Use when modeling least-privilege access, cross-account assumptions, service roles, or reusable IAM stacks that other CloudFormation templates consume.
allowed-tools
Read, Write, Bash

AWS CloudFormation IAM Security

Overview

Use this skill to model IAM with CloudFormation in a way that stays secure, auditable, and maintainable.

The most important design concerns are:

  • separating trust policies from permission policies
  • preferring roles over long-lived users wherever possible
  • keeping least-privilege boundaries readable and reusable

Do not treat SKILL.md as a full IAM encyclopedia. Use the bundled references for larger policy examples and service-specific variants.

When to Use

  • Creating IAM roles for Lambda, ECS, EC2, Step Functions, or other AWS services
  • Defining inline policies, managed policies, and permission boundaries in CloudFormation
  • Modeling cross-account assume-role access with constrained trust policies
  • Exporting IAM role ARNs or managed policy ARNs to downstream stacks
  • Reviewing wildcard permissions, boundary drift, or role replacement risk
  • Creating reusable IAM stacks for platform or application teams

Instructions

1. Define the trust boundary first

Identify who or what assumes the role (service principal, cross-account principal, or federated identity), then write the trust policy with explicit principals and conditions before adding permissions.

2. Grant the minimum permission set

Use inline policies for role-specific access; use managed policies for shared patterns across principals. Scope actions and resources tightly, and use conditions where possible.

3. Apply permission boundaries for delegated role creation

Use permission boundaries when teams create or extend roles in their own stacks, when guardrails are needed around privileged services (IAM, KMS, Organizations), or to separate maximum allowed permissions from application-specific policies.

Name roles and policies consistently so stack outputs and audits remain easy to trace.

4. Model cross-account access

For cross-account roles: trust only the exact source account or principal, add sts:ExternalId conditions when appropriate, keep permission and trust policies separate, and export only the ARNs that consuming accounts need.

5. Validate the template and policy behavior

Before rollout, use these commands to verify the template and IAM behavior:

bash
# Validate CloudFormation template syntax
aws cloudformation validate-template --template-body file://template.yaml

# Preview changes before applying
aws cloudformation create-change-set \
  --stack-name <stack-name> \
  --template-body file://template.yaml \
  --change-set-type CREATE

# Simulate whether a principal can perform specific actions
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/LambdaExecutionRole \
  --action-names dynamodb:GetItem dynamodb:PutItem

# Check for wildcards in IAM policies within the template
aws cloudformation list-stack-resources --stack-name <stack-name>

After deployment, confirm policy attachments and stack outputs match the intended security model.

Show full SKILL.md (188 more words)Show less

Examples

Example 1: Service role for Lambda with tightly scoped permissions
yaml
Resources:
  LambdaExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: DynamoDbWritePolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:GetItem
                  - dynamodb:PutItem
                Resource: !GetAtt OrdersTable.Arn
Example 2: Cross-account role with an external ID condition
yaml
Resources:
  PartnerReadRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              AWS: arn:aws:iam::123456789012:role/partner-reader
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                sts:ExternalId: partner-contract-001

Keep the trust relationship narrow and pair it with a separate read-only permission policy.

Best Practices

  • Prefer IAM roles over long-lived IAM users for application and automation access.
  • Separate trust policies from permission policies when reviewing or refactoring templates.
  • Use permission boundaries when delegating role creation to other teams.
  • Scope resources, actions, and conditions as tightly as the workload allows.
  • Export stable ARNs and names only when another stack truly consumes them.
  • Keep expanded policy libraries and edge cases in references/ instead of bloating the root skill.

Constraints and Warnings

  • Overly broad wildcards in IAM are easy to deploy and hard to notice later.
  • Named IAM resources can be hard to replace safely once other systems depend on them.
  • IAM changes may appear successful in CloudFormation before eventual consistency settles across AWS services.
  • Some Identity Center or organization-wide access patterns need complementary tooling outside a single CloudFormation stack.
  • Misconfigured trust policies are often a bigger risk than missing permissions.

References

  • references/examples.md
  • references/reference.md
  • aws-cloudformation-security
  • aws-cloudformation-ec2
  • aws-cloudformation-ecs
  • aws-cloudformation-lambda

© giuseppe-trisciuoglio, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 2 other files (references) in plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam of giuseppe-trisciuoglio/developer-kit.

  • SKILL.md
  • references/examples.md
  • references/reference.md

Open the folder on GitHubat commit fe73fb3

Compare with similar skills

AWS Cloudformation Iam next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

AWS Cloudformation Iam compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
AWS Cloudformation Iam this skillgiuseppe-trisciuoglio/developer-kit357—~1.5kAutomated safety check: NotesMIT
AWS Cdk Developmentzxkane/aws-skills3672 repos~2.5kAutomated safety check: PassMIT
AWS Cloud Advisortech-leads-club/agent-skills7k—~2.1kAutomated safety check: PassCC-BY-4.0
AWS Native Runtime Investigationpulumi/pulumi-aws-native108—~753Automated safety check: PassApache-2.0
Cloudformationitsmostafa/aws-agent-skills1.2k—~2.5kAutomated safety check: PassMIT
Hunt Bugsgo-to-k/cdkd146—~2.2kAutomated safety check: PassApache-2.0

Similar skills

  • AWS Cdk Development

    zxkane/aws-skills

    AWS Cloud Development Kit (CDK) expert for building cloud infrastructure with TypeScript/Python.

    367 GitHub starsUsed in 2 repos~2.5k tokens
    DevOps & CloudAuto-check passed

  • AWS Cloud Advisor

    tech-leads-club/agent-skills

    Answers AWS architecture, security and service-selection questions by searching AWS documentation through MCP tools first, then adapting advice to your stack and team.

    7k GitHub stars~2.1k tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • AWS Native Runtime Investigation

    pulumi/pulumi-aws-native

    Official

    Use after triage or repository evidence establishes that an issue involves Pulumi AWS Native runtime behavior across the Pulumi provider protocol, generated CloudFormation metadata, and AWS Cloud…

    108 GitHub stars~753 tokensUpdated 2 days ago
    DevOps & CloudAuto-check passed

  • Cloudformation

    itsmostafa/aws-agent-skills

    AWS CloudFormation infrastructure as code for stack management.

    1.2k GitHub stars~2.5k tokensUpdated 5 days ago
    DevOps & CloudAuto-check passed

  • Hunt Bugs

    go-to-k/cdkd

    Proactively hunt for cdkd bugs by deploying real CDK apps that exercise common-but-untested AWS resources, configs, and CloudFormation notations against real AWS, then fix what breaks.

    146 GitHub stars~2.2k tokensUpdated today
    DevOps & CloudAuto-check passed

  • Audit Infrastructure As Code

    cyberful/cyberful

    Audit infrastructure-as-code artifacts for unsafe defaults, policy gaps, privilege exposure, control drift, and deployment-impact evidence.

    135 GitHub stars~649 tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

More from giuseppe-trisciuoglio/developer-kit

All 115 skills in this repo

  • Nestjs Drizzle Crud Generator

    giuseppe-trisciuoglio/developer-kit

    Generates complete CRUD modules for NestJS applications with Drizzle ORM.

    357 GitHub stars~1.3k tokensUpdated 1 mo ago
    Auto-check: notes

  • Spring Boot Actuator

    giuseppe-trisciuoglio/developer-kit

    Provides patterns to configure Spring Boot Actuator for production-grade monitoring, health probes, secured management endpoints, and Micrometer metrics across JVM services.

    357 GitHub stars~2.2k tokensUpdated 1 mo ago
    Auto-check: notes

  • Spring Boot Crud Patterns

    giuseppe-trisciuoglio/developer-kit

    Provides and generates complete CRUD workflows for Spring Boot 3 services.

    357 GitHub stars~2.5k tokensUpdated 1 mo ago
    Auto-check: notes

  • Spring Boot Security JWT

    giuseppe-trisciuoglio/developer-kit

    Provides JWT authentication and authorization patterns for Spring Boot 3.5.x covering token generation with JJWT, Bearer/cookie authentication, database/OAuth2 integration, and RBAC/permission-based…

    357 GitHub stars~3.9k tokensUpdated 1 mo ago
    Auto-check: notes

  • AWS CLI Beast

    giuseppe-trisciuoglio/developer-kit

    Provides advanced AWS CLI patterns for managing EC2, Lambda, S3, DynamoDB, RDS, VPC, IAM, and CloudWatch.

    357 GitHub stars~1.7k tokensUpdated 1 mo ago
    Auto-check: notes

  • PR Review Comments

    giuseppe-trisciuoglio/developer-kit

    Posts review findings from a JSON file as inline comments on a GitHub Pull Request, attaching each comment to its file and line.

    357 GitHub stars~1k tokensUpdated 1 mo ago
    Auto-check: notes

Works with

Categories

Questions about AWS Cloudformation Iam

What does AWS Cloudformation Iam do?

Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships. AWS Cloudformation Iam is an agent skill from giuseppe-trisciuoglio/developer-kit. Provides AWS CloudFormation patterns for IAM roles, policies, managed policies, permission boundaries, and trust relationships.

When should I use AWS Cloudformation Iam?

AWS Cloudformation Iam fits situations like: modeling least-privilege access; cross-account assumptions; reusable IAM stacks that other CloudFormation templates consume.

How do I install AWS Cloudformation Iam in Claude Code?

Run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-iam -a claude-code`. Or copy the skill folder (plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam in giuseppe-trisciuoglio/developer-kit) into .claude/skills/aws-cloudformation-iam in your project. Claude Code loads it when a task matches its description.

How do I install AWS Cloudformation Iam in Codex?

Run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-iam -a codex`. Or copy the skill folder (plugins/developer-kit-aws/skills/aws-cloudformation/aws-cloudformation-iam in giuseppe-trisciuoglio/developer-kit) into .agents/skills/aws-cloudformation-iam in your project. Codex loads it when a task matches its description.

Can I use AWS Cloudformation Iam in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add giuseppe-trisciuoglio/developer-kit --skill aws-cloudformation-iam -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/aws-cloudformation-iam, .gemini/skills/aws-cloudformation-iam, .github/skills/aws-cloudformation-iam and .opencode/skills/aws-cloudformation-iam in your project.

What does AWS Cloudformation Iam need to run?

Going by SKILL.md and its folder, AWS Cloudformation Iam needs the command-line tools its instructions call (aws). Its frontmatter pre-approves these tools: Read, Write, Bash.

Does AWS Cloudformation Iam access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is AWS Cloudformation Iam safe to install?

Our automated static check of SKILL.md found notes only (pre-approves every shell command (allowed-tools: bash)), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does AWS Cloudformation Iam use?

AWS Cloudformation Iam is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does AWS Cloudformation Iam use?

About 1.5k tokens (SKILL.md is roughly 5.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 23k tokens, read only when the agent opens those files.

What are the alternatives to AWS Cloudformation Iam?

Skills that share tags, products or a category with AWS Cloudformation Iam: AWS Cdk Development (zxkane/aws-skills, 367 stars), AWS Cloud Advisor (tech-leads-club/agent-skills, 7k stars), AWS Native Runtime Investigation (pulumi/pulumi-aws-native, 108 stars) and Cloudformation (itsmostafa/aws-agent-skills, 1.2k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains AWS Cloudformation Iam?

giuseppe-trisciuoglio (a GitHub user) maintains it in giuseppe-trisciuoglio/developer-kit, which has 357 GitHub stars. The repository holds 115 skills in this directory. The repository was last updated on September 10, 2026.

Source: giuseppe-trisciuoglio/developer-kit on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.