--- name: orca-identity-review description: Analyzes any cloud identity for overprivileged access, actual usage patterns, lateral movement risk, and least-privilege recommendations. Use when user asks about identity permissions, overprivileged access, or IAM review (e.g., "identity review for anika", "is this role overprivileged", "review permissions", "IAM analysis"). trigger: When user asks to review an identity, check permissions, analyze a role, review IAM access, "is this role overprivileged", "what can this identity do", permission analysis, or identity risk (e.g., "review role admin-role", "is arn:aws:iam::123:role/dev-role overprivileged?", "identity review for terraform-deploy") --- # Orca Identity Review Skill Answers the question: **"Is this identity overprivileged, and what's the blast radius if it's compromised?"** Given an IAM role, user, or service account, analyzes effective permissions vs actual usage from CloudTrail, identifies overprivileged access, maps lateral movement potential, and generates a least-privilege recommendation. ## Usage ``` /orca-identity-review admin-role /orca-identity-review arn:aws:iam::123456789012:role/bastion-admin-role ``` Or natural language: - "review the permissions on admin-role" - "is terraform-deploy overprivileged?" - "identity risk for orca-scanner-role" - "what can this role access?" ## Processing Logic ### Step 1: Find the Identity | Input Pattern | Tool | Parameter | |--------------|------|-----------| | ARN format `arn:aws:iam::...` | `get_asset_by_id` | `asset_id` with appropriate `model_type` | | Role/user name | `get_asset_by_name` | `asset_name`, `model_type: "AwsIamRole"` or `"AwsIamUser"` | | Name (ambiguous) | Try `get_asset_by_name` with each IAM type, or `discovery_search` | If multiple results, show list and ask user to pick. Extract: ARN, identity type (Role/User/ServiceAccount), account, creation date, tags, attached policies. ### Step 2: Gather Data (run ALL in parallel) **Query 1: Effective permissions** ``` get_aws_effective_permissions_policy_on_asset: asset_arn: "" ``` Returns the current effective permissions AND a recommended least-privilege policy. **Query 2: Alerts on this identity** ``` get_asset_related_alerts_summary: asset_id: ``` **Query 3: Alert severity breakdown** ``` get_asset_alerts_count_grouped_by_risk_level: asset_id: ``` **Query 4: What this identity has DONE (CloudTrail)** ``` search_cdr_events: actors: [""] time_range: "last_30_days" limit: 100 ``` **Query 5: Action summary** ``` get_cdr_events_grouped_by_event_name: actors: [""] time_range: "last_30_days" ``` **Query 6: Attack paths** ``` get_asset_related_attack_paths_summary: asset_id: ``` **Query 7: Linked entities** ``` get_linked_entities_mapping: asset_id: ``` **Query 8: Crown jewel status** ``` get_asset_crown_jewel_info: group_unique_id: ``` ### Step 3: Analyze Overprivilege Compare effective permissions vs CDR actual usage: **Used permissions** — actions seen in CloudTrail in last 30 days: - Extract unique action names from CDR events - These are CONFIRMED in-use permissions **Unused permissions** — granted but never used: - All effective permissions MINUS used permissions - The larger this set, the more overprivileged **Dangerous permissions** — high-risk regardless of usage: ``` Permission Pattern Risk ──────────────────────────────────────────────────────── iam:* CRITICAL — full IAM control sts:AssumeRole (broad) HIGH — lateral movement s3:* or s3:GetObject on * HIGH — data exfiltration ec2:RunInstances HIGH — resource hijacking lambda:InvokeFunction HIGH — code execution kms:Decrypt on * HIGH — secret access organizations:* CRITICAL — org-level control iam:CreateUser HIGH — persistence iam:AttachUserPolicy HIGH — privilege escalation iam:PassRole HIGH — privilege escalation ``` **Overprivilege classification:** ``` IF dangerous_unused_permissions > 5 OR has_admin_star THEN "SEVERE" — identity has admin-level access it doesn't use ELSE IF unused_permissions > 50% of total THEN "HIGH" — more than half of permissions are unused ELSE IF unused_permissions > 20% of total THEN "MODERATE" — some excess permissions ELSE "MINIMAL" — well-scoped identity ``` ### Step 4: Assess Lateral Movement Analyze what this identity can REACH: 1. **Role assumption** — can it `sts:AssumeRole`? Which roles? - Check effective permissions for AssumeRole - Check CDR for actual AssumeRole events (what roles were assumed) - Cross-account assumptions = HIGH risk 2. **Resource access** — what services/resources can it touch? - Group effective permissions by AWS service - Flag services with data access (S3, RDS, DynamoDB, Secrets Manager) 3. **Attack path analysis** — is this identity in any kill chains? - From attack paths: role in the chain (entry point, pivot, escalation step) - How many attack paths go through this identity? 4. **CDR patterns** — what has it actually done? - Source IPs (internal, external, VPN, CI/CD) - User-agents (console, CLI, SDK, Terraform) - Time patterns (business hours, 24/7, irregular) ### Step 5: Generate Recommendations Build a specific least-privilege recommendation: 1. **Permissions to REMOVE** — unused AND not in the recommended policy 2. **Permissions to KEEP** — used in CloudTrail in last 30 days 3. **Permissions to REVIEW** — used but potentially overly broad (e.g., `s3:*` when only `s3:GetObject` is used) 4. **Policy suggestion** — the recommended policy from `get_aws_effective_permissions_policy_on_asset` ## Proactive Remediation Behavior **CRITICAL: Never leave the user with just data. After EVERY output layer, suggest the next action and offer to generate remediation code.** After the dashboard and after every drill-down section: 1. **Suggest what to do next** — based on the overprivilege verdict, recommend a specific action 2. **Offer remediation format selection** — always ask: "I can generate the fix. What format do you prefer?" 3. **Supported formats**: Terraform, CloudFormation, Ansible, CLI commands (aws/az/gcloud), step-by-step instructions, Pulumi, ARM/Bicep 4. **Auto-suggest the most impactful fix** — proactively say "The biggest risk reduction is removing X. Want me to generate the updated policy?" When the user selects a format: - Generate the least-privilege IAM policy or remediation code immediately - Write it to a file: `remediate-.` (e.g., `.tf`, `.yml`, `.sh`) - Include verification commands and rollback instructions - Suggest the next fix after the first one is done **Format mapping:** | User says | Extension | Template | |-----------|-----------|----------| | Terraform | `.tf` | HCL with aws_iam_policy resource | | CloudFormation | `.cfn.yaml` | YAML template with IAM resources | | Ansible | `.yml` | Playbook with iam tasks | | CLI | `.sh` | AWS CLI commands for policy updates | | Instructions | inline | Step-by-step console walkthrough | | Pulumi | `.ts` | TypeScript Pulumi IAM program | | ARM/Bicep | `.bicep` | Bicep template for Azure IAM | ## Output Format ### Layer 1: Dashboard ``` ═══════════════════════════════════════════════════════════════════ IDENTITY REVIEW — | | ═══════════════════════════════════════════════════════════════════ VERDICT: ┌─────────────────────────────────────────────────────────────────┐ │ PERMISSIONS effective actions across services │ │ OVERPRIVILEGE │ │ USED (30d) actions actually used │ │ UNUSED actions never used — removal candidates │ │ DANGEROUS high-risk permissions │ │ BLAST RADIUS services,

resources reachable │ │ LATERAL MOVE roles assumable, accounts reachable │ │ ATTACK PATHS kill chains through this identity │ │ ALERTS open ( critical, high) │ │ CDR ACTIVITY events in 30d, unique actions │ │ CROWN JEWEL YES/NO (score: ) │ └─────────────────────────────────────────────────────────────────┘ PERMISSION SUMMARY: Total: effective actions across services Used (30d): actions — KEEP these Unused: actions — candidates for removal Dangerous: TOP RISK: <1-2 sentence summary of the biggest risk with this identity> RECOMMENDED ACTION: What format? terraform | cloudformation | ansible | cli | instructions | pulumi | arm/bicep ═══════════════════════════════════════════════════════════════════ Or drill down: permissions | usage | lateral | attack paths | alerts | activity | recommend | full ═══════════════════════════════════════════════════════════════════ ``` ### Layer 2: Drill-Down Sections #### "permissions" — Full Permission List ``` ─────────────────────────────────────────────────────────────────── PERMISSIONS — ─────────────────────────────────────────────────────────────────── BY SERVICE: ( actions, used): ✓ (last used: ) ✗ REMOVE — never used in 30d ⚠ REVIEW — high risk ( actions, used): ... SUMMARY: Used: (keep) Unused: (remove) Dangerous: (review urgently) READY TO FIX: I can generate an updated policy removing all unused permissions. Choose format: terraform | cloudformation | ansible | cli | instructions | pulumi | arm/bicep ─────────────────────────────────────────────────────────────────── ``` #### "usage" — CDR Activity Details ``` ─────────────────────────────────────────────────────────────────── USAGE — (last 30 days) ─────────────────────────────────────────────────────────────────── Total events: | Unique actions: Source IPs: User-agents: TOP ACTIONS BY FREQUENCY: ... TIME PATTERN: Peak activity: