orca-identity-review

Orca Identity Review Skill

Answers the question: "Is this identity overprivileged, and what's the blast radius if it's compromised?"

Given an IAM role, user, or service account, analyzes effective permissions vs actual usage from CloudTrail, identifies overprivileged access, maps lateral movement potential, and generates a least-privilege recommendation.

Usage

/orca-identity-review admin-role
/orca-identity-review arn:aws:iam::123456789012:role/bastion-admin-role

Or natural language:

• "review the permissions on admin-role"
• "is terraform-deploy overprivileged?"
• "identity risk for orca-scanner-role"
• "what can this role access?"

Processing Logic

Step 1: Find the Identity

Input Pattern	Tool	Parameter
ARN format arn:aws:iam::...	get_asset_by_id	asset_id with appropriate model_type
Role/user name	get_asset_by_name	asset_name, model_type: "AwsIamRole" or "AwsIamUser"
Name (ambiguous)	Try get_asset_by_name with each IAM type, or discovery_search

If multiple results, show list and ask user to pick.

Extract: ARN, identity type (Role/User/ServiceAccount), account, creation date, tags, attached policies.

Step 2: Gather Data (run ALL in parallel)

Query 1: Effective permissions

get_aws_effective_permissions_policy_on_asset:
  asset_arn: "<identity ARN>"

Returns the current effective permissions AND a recommended least-privilege policy.

Query 2: Alerts on this identity

get_asset_related_alerts_summary:
  asset_id: <UUID>

Query 3: Alert severity breakdown

get_asset_alerts_count_grouped_by_risk_level:
  asset_id: <UUID>

Query 4: What this identity has DONE (CloudTrail)

search_cdr_events:
  actors: ["<identity ARN>"]
  time_range: "last_30_days"
  limit: 100

Query 5: Action summary

get_cdr_events_grouped_by_event_name:
  actors: ["<identity ARN>"]
  time_range: "last_30_days"

Query 6: Attack paths

get_asset_related_attack_paths_summary:
  asset_id: <UUID>