iam-best-practiceslisted

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/iam-best-practices/SKILL.md. --> # Identity & Access Management Best Practices Least-privilege IAM design, key rotation, MFA enforcement, role assumption, and cross-account access patterns for AWS / GCP / Azure / Kubernetes ## ALWAYS - Grant the **minimum** permissions required for the workload's stated job (NIST AC-6). Start with a deny-by-default policy and add concrete actions with explicit `Resource` ARNs; never `Action: "*"` combined with `Resource: "*"`. - Prefer **workload identity** (IAM roles for service accounts on EKS, GKE Workload Identity, Azure Managed Identity) over long-lived access keys. Static access keys are the exception, not the default. - Require **MFA** for every human IAM user, especially any principal that can assume a privileged role. Enforce MFA via an IAM policy condition (`aws:MultiFactorAuthPresent: true`), not just a directory-level setting. - Rotate access keys, service-account keys, and signing keys on a documented schedule (≤ 90 days). Detect inactive credentials (≥ 90 days unused) and disable them automatically. - Use **role assumption with `sts:AssumeRole` + ExternalId** for cross-account trust. The ExternalId must be unique per consumer and stored as a secret in both accounts. - Issue **session-scoped** credentials with `MaxSessionDuration ≤ 1h` for human roles and ≤ 1