AI Access Diagnostics Skill for Claude & Codex Permissions

AI Access Diagnostics Skill for Claude & Codex Permissions

The AI Access Diagnostics Skill assists developers in diagnosing IAM and access failures related to AWS Bedrock and SageMaker. By tracing the authorization chain, it identifies the specific point of denial and proposes a scoped IAM policy for review, ensuring a comprehensive understanding of access issues without modifying any permissions.

What this skill does

• Classifies the request by confirming that the service in question is either Bedrock or SageMaker, and verifies the existence of an observed failure.
• Traces the authorization chain, including caller identity, iam:PassRole, trust policies, role permissions, resource policies, and SCPs.
• Identifies the denying hop in the authorization chain when a permission-related failure occurs.
• Proposes a scoped IAM policy for human review, facilitating potential resolutions.
• Addresses access denial errors such as InvokeModel or Converse AccessDeniedException, and issues related to execution roles accessing S3, ECR, or KMS.

Who it is for

• Developers and technical teams using Claude Code, Cursor, or Codex who work with AI/ML services on AWS and encounter IAM-related access issues.
• System administrators managing complex IAM configurations within AI/ML workflows.
• Teams responsible for debugging and resolving authorization failures in AI/ML applications.

Use cases

• Investigating and resolving access denials when a Bedrock or SageMaker service call fails.
• Identifying and understanding the root cause of an "is not authorized to perform" error message.
• Diagnosing execution role failures in accessing resources like S3, ECR, or KMS.
• Analyzing Marketplace and model-subscription denials that are not directly attributed to IAM gaps.

Technical details

• Works with Claude Code, Cursor, and Codex to facilitate AI/ML access diagnostics.
• Utilizes existing IAM configurations to trace the complete authorization process for AI/ML services.
• Provides read-only insights to ensure no changes to configurations are made automatically.

Source & Licence

This package is built on open-source work published by aws (aws/tools-for-devops-agent) and distributed under Apache-2.0. The original licence text and copyright notice are included in your download.

Personal and commercial use, modification and redistribution are permitted under the Apache License 2.0, which also includes an express patent grant. Attribution and any NOTICE file must be retained.

Your purchase covers curation, licence verification, packaging, documentation and instant delivery. It does not grant exclusive rights to the underlying open-source code, which remains available under its original licence.

Delivery & Support

• Delivery: instant — a secure download link is emailed to you as soon as payment is confirmed.
• Format: ZIP archive containing the skill files, documentation and the original licence.
• Support: support@mcpcart.com — we aim to reply within 2 business days.
• Updates: updates are included only where stated on this page.

Refunds

This is a digital product delivered immediately after purchase. By completing your order you request immediate delivery and acknowledge that, once the download has been accessed, the statutory right to cancel no longer applies to the extent permitted by law. Refund requests are handled in accordance with our published Refund Policy.

Claude, Codex, Gemini and Cursor are trademarks of their respective owners. MCP Cart is an independent marketplace and is not affiliated with, endorsed by, or sponsored by any of them. Compatibility references describe interoperability only.