Orca Identity Review Skill

Answers the question: "Is this identity overprivileged, and what's the blast radius if it's compromised?"

Given an IAM role, user, or service account, analyzes effective permissions vs actual usage from CloudTrail, identifies overprivileged access, maps lateral movement potential, and generates a least-privilege recommendation.

Usage

/orca-identity-review admin-role
/orca-identity-review arn:aws:iam::123456789012:role/bastion-admin-role

Or natural language:

• "review the permissions on admin-role"
• "is terraform-deploy overprivileged?"
• "identity risk for orca-scanner-role"
• "what can this role access?"