AI agent IAM: IAM for Agents: Roles, Not God Keys

# terraform/agent_roles.tf
resource "aws_iam_role" "agent_s3_read" {
  name = "agent-s3-read"
  assume_role_policy = data.aws_iam_policy_document.agent_trust.json
}

resource "aws_iam_role" "agent_sandbox_apply" {
  name = "agent-sandbox-apply"
  assume_role_policy = data.aws_iam_policy_document.agent_trust.json
}

# creds.py
import boto3
sts = boto3.client("sts")

def session_for(tool_family: str, run_id: str):
    role = ROLES[tool_family]
    out = sts.assume_role(
        RoleArn=role,
        RoleSessionName=f"agent-{run_id}"[:64],
        DurationSeconds=900,
        Tags=[{"Key": "run_id", "Value": run_id}],
    )
    c = out["Credentials"]
    return boto3.Session(
        aws_access_key_id=c["AccessKeyId"],
        aws_secret_access_key=c["SecretAccessKey"],
        aws_session_token=c["SessionToken"],
    )

aws accessanalyzer validate-policy \
  --policy-document file://proposed.json \
  --policy-type IDENTITY_POLICY