cloud-securitylisted
Install: claude install-skill Mattakushi432/Claude-Code-Skills-Custom-DevTools-Pack
# Cloud Security Patterns
## IAM Least Privilege
```json
// AWS — service-specific role, no wildcards
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::my-app-data/*",
"Condition": {
"StringEquals": {
"s3:prefix": ["uploads/${aws:userid}/"]
}
}
}
]
}
```
```bash
# Find overly permissive policies
aws iam get-account-authorization-details \
--query 'UserDetailList[*].AttachedManagedPolicies'
# IAM Access Analyzer — find external access
aws accessanalyzer create-analyzer \
--analyzer-name account-analyzer \
--type ACCOUNT
# List findings
aws accessanalyzer list-findings --analyzer-name account-analyzer
```
## Service Control Policies (AWS Organizations)
```json
// Prevent disabling CloudTrail across all accounts
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyCloudTrailDisable",
"Effect": "Deny",
"Action": [
"cloudtrail:DeleteTrail",
"cloudtrail:StopLogging",
"cloudtrail:UpdateTrail"
],
"Resource": "*"
},
{
"Sid": "DenyLeaveOrg",
"Effect": "Deny",
"Action": "organizations:LeaveOrganization",
"Resource": "*"
},
{
"Sid": "RequireMFA",
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"BoolIfExists": {"aws:MultiFactorAuthPresent": "fal