Show HN: Policy_sentry, an AWS IAM Least Privilege Policy Generator

Related, I've been wondering if there's a tool that will generate a least-privilege policy out of an existing set of AWS CloudTrail records. It would be wonderful if I could run terraform from an admin user, pull down the API calls, and build a policy from them.

Sorry for a shameless self-promotion but I&#x27;ve recently written a piece about how it&#x27;s a common practice to grant web apps a full access to S3 resources using a simple IAM policy and what risks it causes <a href="https:&#x2F;&#x2F;pawelurbanek.com&#x2F;s3-iam-config" rel="nofollow">https:&#x2F;&#x2F;pawelurbanek.com&#x2F;s3-iam-config</a>

&gt; and there&#x27;s no automated tool that will automagically sense the AWS API calls that you perform and then write them for you in a least-privilege manner.<p>Netflix released one two years ago: <a href="https:&#x2F;&#x2F;medium.com&#x2F;netflix-techblog&#x2F;introducing-aardvark-and-repokid-53b081bf3a7e" rel="nofollow">https:&#x2F;&#x2F;medium.com&#x2F;netflix-techblog&#x2F;introducing-aardvark-and...</a>

I have a question, I recently had the opportunity to use AWS CDK (<a href="https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;cdk&#x2F;latest&#x2F;guide&#x2F;home.html" rel="nofollow">https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;cdk&#x2F;latest&#x2F;guide&#x2F;home.html</a>) for a project. It seemed to me that CDK automatically does this to a certain degree and if CDK is the future for AWS infrastructure provisioning, this issue should organically go away. Anyone have any input?

Neat project.<p>How does it differ from `aws-iam-generator` released by AWS themselves?<p><a href="https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;aws-iam-generator" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;awslabs&#x2F;aws-iam-generator</a>

At first glance (by the name) I thought this was something that analyzed your AWS usage based on API logs and created an &quot;ideal&quot; policy for to use (or recommend permissions to remove&#x2F;add).

Is there any way to block the creation of policies containing specific permissions or resources? I know this can be trivially circumvented but if this tool is used in ci&#x2F;cd it can be a good gate.

In a funny not serious but also totally serious way I want to be friends with everyone who cares about the fact that this repo exists regardless of if they think its worth using.

I completely understand (and have had) the problem, but I don&#x27;t understand the solution that this offers?<p>Or rather, I didn&#x27;t without going Readme &gt; Wiki &gt; User Guide &gt; something else - a YAML example should really be in the readme, this looks great!