agentmods.dev

aws-identity-and-security

aws-identity-and-security is a skill for Claude Code from jsgerman-oss/blackrim-nimbus-skills. It costs 67 tokens per session (1,673 once invoked), scanned A, original, MIT.

An AWS security guide for controlling who and what can access cloud resources, secrets, and keys. It covers services such as IAM, single sign-on, encryption keys, threat detection, and audit logs.

In plain words
What is it for?
Use it to write or review access policies, set up single sign-on, manage roles for applications and CI systems, rotate secrets and keys, add account-wide security controls, and investigate access events.
Why use it?
It helps prevent overly broad permissions, exposed long-lived access keys, and secrets that are hard to rotate or trace. It also supports investigating suspicious activity in an AWS account.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: positional $N argument.

Part of the cloud-aws plugin — 6 skills, 1 command, 2 agents shipped together

not rated 8repo 26d ago A scan 67 tokens original MIT

Good fit Use it to write or review access policies, set up single sign-on, manage roles for applications and CI systems, rotate secrets and keys, add account-wide security controls, and investigate access events.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security
View source ↗ jsgerman-oss/blackrim-nimbus-skills
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add jsgerman-oss/blackrim-nimbus-skills --skill aws-identity-and-security
Clone the repo
git clone --depth 1 https://github.com/jsgerman-oss/blackrim-nimbus-skills

Made for: Claude Code.

Or install cloud-aws, the plugin that ships this one along with the rest of its 6 skills, 1 command, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for aws-identity-and-security

README.md
[![agentmods](https://agentmods.dev/badge/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security/github.svg)](https://agentmods.dev/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security)
Your own site
<a href="https://agentmods.dev/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security"><img src="https://agentmods.dev/badge/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for aws-identity-and-security

Your own site · 80×15
<a href="https://agentmods.dev/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security"><img src="https://agentmods.dev/badge/skills/jsgerman-oss/blackrim-nimbus-skills/aws-identity-and-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 67 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,673 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00067 $0.01673
Opus 5 $0.00034 $0.00837
Sonnet 5 $0.00013 $0.00335
Haiku 4.5 $0.00007 $0.00167

Measured 12d ago against content hash bb34d4f85cd6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

aws-identity-and-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

cloud-aws/skills/aws-identity-and-security/SKILL.md · 116 lines

How it starts

The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AWS Identity and Security

When to use

  • Writing or reviewing an IAM policy / role / trust relationship.
  • Standing up an account, an org, or a new SSO permission set.
  • Rotating, scoping, or auditing secrets and keys.
  • Setting up org-wide guardrails (SCPs, GuardDuty, Security Hub).
  • Investigating an incident — CloudTrail forensics, IAM Access Analyzer findings.

Identity model

  • Humans → IAM Identity Center (SSO). Federate from your IdP (Okta, Entra ID, Google, JumpCloud). No long-lived IAM users for humans.
  • Workloads → IAM roles assumed by the runtime (Lambda execution role, ECS task role, IRSA for EKS, EC2 instance profile). No static access keys.
  • External integrations → OIDC + IAM role with a trust policy gated on aud / sub claims (GitHub Actions, GitLab CI, Buildkite). Never store an AKIA... in CI secrets.
  • Programmatic break-glass → temporary credentials via aws sts assume-role with MFA, time-bounded, audit-logged.

IAM policy discipline

  • Default deny. Every Allow is justified.
  • Resource-level ARNs, not Resource: "*". If the service supports resource-level perms, use them.
  • Conditions for context: aws:SourceVpc, aws:PrincipalOrgID, aws:SecureTransport=true, aws:MultiFactorAuthPresent, aws:ResourceTag/Environment=prod.
  • Permission boundaries on dev-owned roles so devs can grant access but not escalate above the boundary.
  • Service Control Policies (SCPs) at the org / OU level to set hard limits even root can't exceed (e.g., deny region usage outside an approved list, deny disabling CloudTrail).
  • IAM Access Analyzer in every account. Findings are not optional.

KMS

  • Customer-managed CMKs for anything you might need to revoke, rotate, or audit per-key.
  • Key policy first-class: explicit Principal ARNs for who can use vs admin the key. No kms:* to *.
  • Automatic rotation on for symmetric keys (yearly).
  • Multi-region keys only when you have a real cross-region requirement; otherwise keep keys regional.
  • Separate keys by domain (db / storage / logs) so a single compromise doesn't unlock everything.

Read the full file on GitHub · 116 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 116 lines · 67 tokens per session scan A bb34d4f85cd6

Subscribe to this mod's changes

aws-identity-and-security is a skill published in the GitHub repository jsgerman-oss/blackrim-nimbus-skills (8 stars, last pushed 26d ago), licensed MIT. It adds 67 tokens to every session and 1,673 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

CloudDevOps and cloudSecurity
Related

Other skills, from other repositories

gke-compute-classes

Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…

google/skills · 83 tokens

gke-reliability

Improves GKE workload reliability, using PDBs, health probes, and topology spread constraints. Use when configuring GKE workload reliability, setting up PDBs, or configuring GKE health probes (liveness, readiness, startup). Don't use for disaster recovery setup or full cluster backups (use gke-backup-dr instead).

google/skills · 73 tokens

gke-workload-security

Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running cluster security audits (auditcluster.sh), configuring Workload Identity Federation (impersonation, KSA/GSA binding, and pod setup), enforcing Network Policies (default-deny…

google/skills · 181 tokens

nemo-automodel-launcher-config

Configure NeMo AutoModel job launches for interactive runs, Slurm clusters, and SkyPilot cloud execution.

NVIDIA/skills · 30 tokens

azure-mgmt-botservice-dotnet

Azure Resource Manager SDK for Bot Service in .NET. Management plane operations for creating and managing Azure Bot resources, channels (Teams, DirectLine, Slack), and connection settings. Triggers: "Bot Service", "BotResource", "Azure Bot", "DirectLine channel", "Teams channel", "bot management .NET", "create bot".

microsoft/skills · 78 tokens

cloud-architect

Designs cloud architectures, creates migration plans, generates cost optimization recommendations, and produces disaster recovery strategies across AWS, Azure, and GCP. Use when designing cloud architectures, planning migrations, or optimizing multi-cloud deployments. Invoke for Well-Architected Framework, cost…

Jeffallan/claude-skills · 71 tokens