iam-audit
IAM Audit — Identity & Access Management Review and Design
Cover the identity and access layer end-to-end: audit existing setup, design from scratch, plan migrations, and codify the patterns most teams get wrong. This is the consultant-style skill — not just "what's misconfigured" but "what should this look like."
Three modes — pick the one that matches the engagement:
- Audit — review what's already deployed, find privilege creep and gaps
- Design — greenfield IAM for a new project or new identity provider
- Migrate — consolidate multiple identity providers, federate access, move to SSO
Cross-references: cloud-audit for the cloud-provider audit (broader than IAM), container-audit for K8s RBAC and ServiceAccounts (orchestration-layer identity), personal-opsec for the individual operator's own accounts — hardware-key MFA, recovery paths, SIM-swap protection — which org IAM doesn't reach; cicd-security for the CI side of OIDC federation (which workflows and refs can assume a cloud role).
Authorization
Audit only identity providers, cloud accounts and applications the user owns or is authorized to review, with read access granted for that purpose. The pre-approved commands read policies and findings. Never change a role, remove a user, rotate credentials or try a privilege-escalation path live during the audit: report the path and the fix, and let the owner act.