Ram Iam Audit

---
name: ram-iam-audit
description: Use when reviewing AWS IAM or Alibaba Cloud RAM for least-privilege — hunting wildcard Action/Resource (`*:*`, `*`), AdministratorAccess / *FullAccess over-grants, long-lived access keys instead of roles, unused or stale credentials, over-broad cross-account trust, inline policies, missing MFA, and privilege-escalation combos (iam:PassRole + compute, policy self-attach). Read-only audit that names each risk with evidence and a concrete tightening, applying no changes.
---

# ram-iam-audit

A read-only least-privilege review of AWS **IAM** and Alibaba Cloud **RAM** that
turns "are our permissions too loose?" into a *ranked list of named risks, each with
the evidence and the exact tightening*. The enemy is the policy that *reads* safe but
*grants* broad — a managed policy named like a read-only role that actually carries a
wildcard, a `PassRole` that quietly enables full privilege escalation. This skill
makes you read what a policy **grants**, not what it's **called**.

## When to use

Reach for this when someone asks to:

- review IAM/RAM for least privilege, or "are our permissions too broad?"
- onboard/offboard a user/role/RAM user and check the grant is minimal
- audit before exposing an account, automating with a key, or a security review
- investigate "who can do X" / blast-radius of a credential leak

Do **not** use it to *create or modify* policies, to manage SSO/identity federation
setup, or to design an org-wide SCP strategy from scratch — this is an audit that… install to load the full skill