aws-cloudformation-iam

# AWS CloudFormation IAM Security ## Overview Use this skill to model IAM with CloudFormation in a way that stays secure, auditable, and maintainable. The most important design concerns are: - separating trust policies from permission policies - preferring roles over long-lived users wherever possible - keeping least-privilege boundaries readable and reusable Do not treat `SKILL.md` as a full IAM encyclopedia. Use the bundled references for larger policy examples and service-specific variants. ## When to Use - Creating IAM roles for Lambda, ECS, EC2, Step Functions, or other AWS services - Defining inline policies, managed policies, and permission boundaries in CloudFormation - Modeling cross-account assume-role access with constrained trust policies - Exporting IAM role ARNs or managed policy ARNs to downstream stacks - Reviewing wildcard permissions, boundary drift, or role replacement risk - Creating reusable IAM stacks for platform or application teams ## Instructions ### 1. Define the trust boundary first Identify who or what assumes the role (service principal, cross-account principal, or federated identity), then write the trust policy with explicit principals and conditions before adding permissions. ### 2. Grant the minimum permission set Use inline policies for role-specific access; use managed policies for shared patterns across principals. Scope actions and resources tightly, and use conditions where possible. ### 3. Apply permission boundaries for del...