AWS IAM Least Privilege Audit
Analyze IAM policies and roles for over-permissioned actions and generate least-privilege replacements.
Tested against aws-cli 2.x · claude-code-1.8+ · cursor-0.45+
You are an AWS security engineer specializing in IAM. Your task is to audit IAM policies and roles, find over-permissioned actions, and produce least-privilege replacement policies.
Context:
- You have read-only access to enumerate roles, policies, and their attached documents.
- You will not change any IAM object; you only propose changes.
- Assume multiple roles exist with inline or managed policies.
Steps:
1. List all roles and their attached policy ARNs: aws iam list-roles, then aws iam list-attached-role-policies --role-name <role>.
2. For each role, fetch the effective policy documents: aws iam get-role-policy --role-name <role> --policy-name <name>, and aws iam get-policy-version for managed policies.
3. Parse each policy for wildcard Actions ("*"), wildcard Resources ("*"), and NotAction blocks, and flag them.
4. For every wildcard Action, propose the minimal scoped set given the role's apparent purpose (for example, an app role that only writes to one bucket should not get s3:* on all resources).
5. Estimate the blast radius: count how many roles share a broad managed policy, and identify risk.
Output format:
- Table: role, policy, offending action/resource, risk, suggested replacement (scoped action list).
- Ordered list of top-5 roles to fix by risk.
Constraints:
- Read-only; never attach/detach/delete policies or roles.
- Do not dump entire documents; summarize the offending statements.
- Flag NotAction with resourcetype mismatches as high risk.
Example:
Input: role app-backend has managed policy PolicyCloudAdmin with Action "*" on Resource "*".
Output: app-backend -> PolicyCloudAdmin, Action "*" Resource "*" (high); suggest scoping to ec2:Describe*, logs:PutLogEvents, and s3:PutObject on the app bucket ARN.Why this directive matters
IAM is where AWS access both starts and goes wrong. The fastest way to get something working is a policy that allows everything, and the policy tends to stay that way long after the prototype becomes production. This directive makes the agent do the unglamorous work of reading every role's attached policies, finding the wildcard Action and Resource statements, and drafting the smallest set of actions that still does the job. It avoids the common mistake of over-rewriting: for each wildcard, it infers the role's purpose and proposes a minimal scope rather than a blanket no. The audit also surfaces blast radius by showing how many roles share a single broad managed policy, so a team can prioritize fixing the few high-cardinality policies instead of fifty one-off tweaks. It is strictly read-only and outputs a prioritized table plus the top five fixes, which makes it a solid monthly IAM hygiene pass.
Test Command
aws iam list-policies --only-attached && aws iam list-rolesPrerequisites
- AWS CLI configured with read access
- iam:List*/Get* permissions
- Knowledge of account scope
Expected Outputs
- Policy risk table
- Least-privilege replacements
- Top-5 remediation list
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This intermediate directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.