Agent Plugins Marketplace
← All plugins

aws-security-identity

v0.1.0

Security and identity skills for the main agent: least-privilege IAM, Security Hub/GuardDuty/Inspector findings, Cognito authentication, and Secrets Manager best practices, with read-only IAM, Well-Architected security, and AWS Security Agent MCP servers and the secret-safety hook.

CodexClaude CodeAgent Plugins5 Skills3 MCP serversstdio

By TalkOps AILicense: Apache-2.00 GitHub starsUpdated last week

Directory evidence

Runtimes
Codex, Claude Code, and Agent Plugins
Parsed components
8 skill or MCP entries
Source updated
Oct 10, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install aws-security-identity for Codex and Claude Code

Installs for the current user
codex plugin marketplace add talkops-ai/devops-plugins
codex plugin marketplace upgrade talkops-devops-plugins
codex plugin add aws-security-identity@talkops-devops-plugins

Paste and run these commands in a terminal with Codex. They add and refresh the talkops-devops-plugins catalog, then install this plugin.

Compatibility: the page URL and API slug “aws-security-identity” remain stable.

  • Codex: aws-security-identity@agent-plugin-marketplace → aws-security-identity@talkops-devops-plugins

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/talkops-ai/devops-plugins

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/vertical-plugins/aws-security-identity/.

Plugin files

plugins/vertical-plugins/aws-security-identity/
├── .codex-plugin/plugin.json
├── .claude-plugin/plugin.json
├── plugin.json
├── skills/aws-auth/SKILL.md
├── skills/aws-iam/SKILL.md
├── skills/aws-secrets-manager/SKILL.md
├── skills/aws-security/SKILL.md
├── skills/creating-secrets-using-best-practices/SKILL.md
└── .mcp.json

Included Skills5

aws-authskills/aws-auth/SKILL.md

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

aws-iamskills/aws-iam/SKILL.md

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

aws-secrets-managerskills/aws-secrets-manager/SKILL.md

Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching secret values and teaches runtime dynamic references with asm-exec so plaintext never enters the LLM context window.

aws-securityskills/aws-security/SKILL.md

Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries; Security Hub CSPM (V1/ASFF) controls and compliance standards; GuardDuty threat findings; Inspector vulnerability findings; Macie sensitive data findings; Detective investigation; and Security Lake configuration and data aggregation. Applicable when questions involve security posture, Exposure findings, CSPM failed controls, threat findings, vulnerability findings, sensitive data findings, automation rules, or cross-service security configuration across AWS environments. Procedures use standard AWS CLI syntax and work with or without the AWS MCP server.

creating-secrets-using-best-practicesskills/creating-secrets-using-best-practices/SKILL.md

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

MCP servers3

aws-mcpstdio
command
uvx
args
mcp-proxy-for-aws-cli==1.7.0 https://aws-mcp.us-east-1.api.aws/mcp --skip-auth --metadata INSTALL_SOURCE=agent-toolkit-core
iamstdio
command
uvx
args
awslabs.iam-mcp-server@latest
env.FASTMCP_LOG_LEVEL
ERROR
wa-securitystdio
command
uvx
args
awslabs.well-architected-security-mcp-server@latest
env.FASTMCP_LOG_LEVEL
ERROR

Plugin manifests3

plugins/vertical-plugins/aws-security-identity/.codex-plugin/plugin.json
{
  "name": "aws-security-identity",
  "version": "0.1.0",
  "description": "Security and identity skills for the main agent: least-privilege IAM, Security Hub/GuardDuty/Inspector findings, Cognito authentication, and Secrets Manager best practices, with read-only IAM, Well-Architected security, and AWS Security Agent MCP servers and the secret-safety hook.",
  "author": {
    "name": "TalkOps AI"
  },
  "homepage": "https://github.com/talkops-ai/devops-plugins",
  "repository": "https://github.com/talkops-ai/devops-plugins",
  "license": "Apache-2.0",
  "keywords": [
    "aws",
    "security",
    "iam",
    "secrets-manager",
    "cognito",
    "security-hub",
    "guardduty",
    "least-privilege"
  ],
  "skills": "./skills/",
  "mcpServers": "./mcp.json",
  "hooks": "./hooks/hooks.json",
  "interface": {
    "displayName": "AWS Security and Identity",
    "shortDescription": "Security and identity skills for the main agent",
    "longDescription": "Security and identity skills for the main agent: least-privilege IAM, Security Hub/GuardDuty/Inspector findings, Cognito authentication, and Secrets Manager best practices, with read-only IAM, Well-Architected security, and AWS Security Agent MCP servers and the secret-safety hook.",
    "developerName": "TalkOps AI",
    "category": "Cloud",
    "capabilities": [
      "Read",
      "Write"
    ],
    "websiteURL": "https://github.com/talkops-ai/devops-plugins/tree/main/plugins/vertical-plugins/aws-security-identity",
    "brandColor": "#FF9900"
  }
}
plugins/vertical-plugins/aws-security-identity/.claude-plugin/plugin.json
{
  "name": "aws-security-identity",
  "version": "0.1.0",
  "description": "Security and identity skills for the main agent: least-privilege IAM, Security Hub/GuardDuty/Inspector findings, Cognito authentication, and Secrets Manager best practices, with read-only IAM, Well-Architected security, and AWS Security Agent MCP servers and the secret-safety hook.",
  "author": {
    "name": "TalkOps AI"
  },
  "homepage": "https://github.com/talkops-ai/devops-plugins",
  "repository": "https://github.com/talkops-ai/devops-plugins",
  "license": "Apache-2.0",
  "keywords": [
    "aws",
    "security",
    "iam",
    "secrets-manager",
    "cognito",
    "security-hub",
    "guardduty",
    "least-privilege"
  ]
}
plugins/vertical-plugins/aws-security-identity/plugin.json
{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "aws-security-identity",
  "version": "0.1.0",
  "description": "Security and identity skills for the main agent: least-privilege IAM, Security Hub/GuardDuty/Inspector findings, Cognito authentication, and Secrets Manager best practices, with read-only IAM, Well-Architected security, and AWS Security Agent MCP servers and the secret-safety hook.",
  "author": {
    "name": "TalkOps AI"
  },
  "homepage": "https://github.com/talkops-ai/devops-plugins",
  "repository": "https://github.com/talkops-ai/devops-plugins",
  "license": "Apache-2.0",
  "keywords": [
    "aws",
    "security",
    "iam",
    "secrets-manager",
    "cognito",
    "security-hub",
    "guardduty",
    "least-privilege"
  ]
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[aws-security-identity on Agent Plugins Marketplace](https://pluginsmp.com/plugins/aws-security-identity)