Investigate IAM privilege

What this does

Produces a structured IAM privilege report for an AWS environment by querying the SubImage graph. Collapses the typical multi-turn pattern (admin policy lookup → trust chain → SSO/PermissionSet mapping) into one investigation: who is effectively admin, how trust flows between roles and accounts, and what each Identity Center PermissionSet actually grants.

When to use

✅ "Who has admin access in account X?" / "list privilege escalation paths". ✅ "Which roles can be assumed from another account?" (cross-account trust). ✅ "What does PermissionSet Y actually provision?" ✅ Periodic IAM hygiene review on a specific account or role.

❌ A single specific resource lookup a structured tool answers directly (e.g. one user's attached policies): query it directly. ❌ The full attack-path picture from a compromised identity: hand off to subimage-mcp:review-attack-path. ❌ Non-AWS identity providers as the primary subject: this skill is AWS IAM / Identity Center centric (Okta→AWS mapping is included as a join, not the focus).

Prerequisites