orca-identity-review

# Orca Identity Review Skill Answers the question: **"Is this identity overprivileged, and what's the blast radius if it's compromised?"** Given an IAM role, user, or service account, analyzes effective permissions vs actual usage from CloudTrail, identifies overprivileged access, maps lateral movement potential, and generates a least-privilege recommendation. ## Usage ``` /orca-identity-review admin-role /orca-identity-review arn:aws:iam::123456789012:role/bastion-admin-role ``` Or natural language: - "review the permissions on admin-role" - "is terraform-deploy overprivileged?" - "identity risk for orca-scanner-role" - "what can this role access?" ## Processing Logic ### Step 1: Find the Identity | Input Pattern | Tool | Parameter | |--------------|------|-----------| | ARN format `arn:aws:iam::...` | `get_asset_by_id` | `asset_id` with appropriate `model_type` | | Role/user name | `get_asset_by_name` | `asset_name`, `model_type: "AwsIamRole"` or `"AwsIamUser"` | | Name (ambiguous) | Try `get_asset_by_name` with each IAM type, or `discovery_search` | If multiple results, show list and ask user to pick. Extract: ARN, identity type (Role/User/ServiceAccount), account, creation date, tags, attached policies. ### Step 2: Gather Data (run ALL in parallel) **Query 1: Effective permissions** ``` get_aws_effective_permissions_policy_on_asset: asset_arn: "<identity ARN>" ``` Returns the current effective permissions AND a recommended least-privilege policy. **Query 2:...