'iam' 검색 결과

Check Google Cloud IAM allow policy changes against the last 90 days of access logs. The skill identifies access that could be lost and applies changes only after a successful simulation and user approval.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking access impact before removing a role
• Reviewing allow policy changes across resource scopes
• Applying policy changes after simulation and approval

Analyze AWS IAM access policies with boto3 and Cloudsplaining-style checks to find permissions that could grant greater access. Produces a JSON report linking risky permissions to users or roles, with severity ratings and remediation guidance.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Audit AWS IAM policies for excessive permissions
• Find permission combinations that enable privilege escalation
• Trace risky policies to affected users and roles

Inspect and manage Google Cloud IAM policies that grant roles or explicitly deny permissions. The skill prepares policy changes for user approval, supports organization, folder, project, and supported resource scopes, and verifies the resulting policy after execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing existing allow and deny policies
• Adding or removing role bindings for specific identities
• Creating or updating organization, folder, or project deny policies

Audit Google Cloud access permissions to find overly broad roles, unnecessary service account keys, public access, and impersonation risks. Use gcloud CLI, Policy Analyzer, and IAM Recommender to document findings and plan more limited permissions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing access permissions across a GCP organization
• Replacing broad Owner and Editor roles with narrower roles
• Auditing unused service accounts and user-managed keys

Prepare SageMaker deployments and training by finding existing execution roles, checking trust settings, and reviewing required permissions. Guides role creation only when necessary and identifies permission issues that require an AWS administrator.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check execution roles before deploying a SageMaker endpoint
• Find an existing role when no ARN is provided
• Investigate IAM AccessDenied errors

Support authorized penetration testing of AWS environments by examining IAM permissions and resources such as S3, EC2, and Lambda. It guides identifying privilege escalation paths, where access can be expanded, and documenting security audit findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review IAM permissions for privilege escalation paths
• Assess access to S3 buckets and Lambda functions
• Validate credential exposure risks through EC2 metadata

Diagnose why GKE Pods cannot authenticate to Google Cloud APIs. Inspect cluster settings, service account bindings, resource permissions, and metadata server health, then provide evidence and concrete fixes for a human to apply.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate Pod authentication failures and 403 errors
• Check Kubernetes service account identity bindings
• Diagnose metadata server connectivity problems

Review Slack access requests against Okta role and team information, then prepare narrowly scoped GitHub or AWS IAM permissions. Apply changes only after an eligible person's approval and record the grant, reasoning, approver, and timestamp.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing GitHub repository access requests from Slack
• Preparing AWS IAM permissions for a specific task
• Routing sensitive access requests for additional review

Manage temporary access in Google Cloud with Privileged Access Manager. Configure who can request which roles and for how long, maintain access configurations, and handle access requests and approval decisions through guided workflows.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Request temporary access to Google Cloud resources
• Configure eligible requesters and approvers
• Review and approve or deny pending access requests

Plan and configure security across Google Kubernetes Engine clusters. Review access permissions, enable Secret Manager integration, and configure protections such as Shielded Nodes and Binary Authorization to strengthen the platform supporting your applications.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review cluster access permissions
• Enable Secret Manager integration
• Configure Shielded Nodes and GKE Sandbox

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Ensure a usable SageMaker execution role exists before deploying or training. Use this skill whenever about to create a SageMaker endpoint, model, training job, or any resource that requires an execution role. Use it especially when the user has not provided a role ARN explicitly, when scripts are about to call `iam:CreateRole`, or when an AccessDenied error mentions an IAM action. Never blindly call `iam:CreateRole` — always check for existing roles first. This skill prevents the most common SageMaker deployment failure: trying to create IAM resources from an SSO principal that has no IAM write permissions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Configure and audit AWS users, roles, and access policies. Work through least-privilege permissions, granting only the access needed, along with GitHub Actions authentication, cross-account access, permission boundaries, and checks for unused or excessive access.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create execution roles for EC2 and Lambda
• Design policies with only the required permissions
• Configure GitHub Actions authentication through OIDC

Assess serverless functions, primarily AWS Lambda, for unsafe execution of external input and unauthorized changes to code or added libraries. Combine source inspection, activity logs, and permission reviews to identify injection risks and recommend detection and prevention measures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Lambda event handlers for injection vulnerabilities
• Investigating unauthorized function or layer changes
• Checking privilege escalation through Lambda execution roles

Build automated responses to AWS GuardDuty security findings using EventBridge and Lambda. Configure severity filters, isolate EC2 instances, disable compromised access keys, preserve disk snapshots for investigation, and send notifications to security teams.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triggering responses to high-severity GuardDuty findings
• Isolating EC2 instances and preserving investigation data
• Disabling compromised IAM access keys

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AWS IAM Best Practices workflow skill. Use this skill when the user needs IAM policy review, hardening, and least privilege implementation and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AWS CLIの専門家スキル。EC2, S3, IAM, Lambda, RDS, ECS等の主要サービスのCLI操作を支援。IAMポリシー設計、クロスアカウント運用、セキュリティ設定、コスト最適化のベストプラクティスを提供。Use when working with AWS services via CLI, designing IAM policies, managing infrastructure, or automating cloud operations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze AWS CloudTrail logs against normal activity patterns to spot unusual API calls, IP addresses, errors, and sensitive changes. Produce a JSON report with anomaly scores, suspicious users, and suggested investigation steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating possible misuse of AWS credentials
• Finding first-time API calls and unusual IP activity
• Reviewing IAM, KMS, and S3 policy changes

Plan, deploy, and manage AWS infrastructure across computing, storage, networking, and serverless services. Get guidance on access permissions, backups, auditing, and cost management using AWS CLI and tools that define infrastructure in code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan configurations for EC2, S3, and Lambda
• Review IAM permissions and network access
• Identify unused resources and review costs

Check the AWS profile, region, account ID, and caller identity before starting AWS work. Read local configuration and validate credentials, then flag missing settings, expired access, or possible IAM restrictions associated with SSO authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check the AWS account and region before deployment
• Identify the active profile when none was specified
• Detect expired credentials or missing configuration

AWS IAM Best Practices workflow skill. Use this skill when the user needs IAM policy review, hardening, and least privilege implementation and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Streamlines the creation, modification, and management of IAM allow policies (v1) and deny policies (v2). Manages access control across Resource Manager resources (Organization, Folder, Project) and individual resources. Use when creating, updating, listing, or deleting IAM allow policies or deny policies. Don't use for access denial troubleshooting (use iam-helper-for-troubleshooting), temporary privileged access (use iam-helper-for-privileged-access-management), configuring VPC Service Controls, or managing network firewall rules.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.