An AWS IAM to least privilege Terraform execution framework that analyzes usage patterns and generates right-sized IAM configurations.
AirIAM is an AWS IAM to least privilege Terraform execution framework that scans existing IAM usage patterns and generates right-sized Terraform configurations. It solves the problem of manual, error-prone IAM management by automating the migration to immutable, version-controlled infrastructure-as-code. The tool identifies unused resources and creates least-privilege policies based on actual usage data.
AWS administrators, DevOps engineers, and security teams managing IAM configurations in AWS accounts who want to enforce least privilege and migrate to Terraform-based management.
Developers choose AirIAM because it uniquely combines IAM usage analysis with automated Terraform generation, providing a seamless migration path to least-privilege IAM-as-code while integrating with existing tools like Checkov for policy validation.
Least privilege AWS IAM Terraformer
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Scans AWS IAM usage with native APIs and Access Advisor to identify unused users, roles, and policies over a configurable threshold, as detailed in the 'find_unused' command.
Compiles IAM data into Terraform code for version-controlled management, with commands like 'terraform' that output ready-to-use configurations and handle state imports.
Integrates with Checkov for static-code analysis to track configuration drift and enforce security policies, enhancing governance in infrastructure-as-code workflows.
Analyzes actual permissions in use to recommend standardized groups (Admins, PowerUsers, ReadOnly), simplifying IAM structure based on real access patterns.
The README advises contacting support for Prod account migrations, indicating potential risks or unsuitability for critical environments without expert guidance.
Importing existing IAM entities to Terraform state can be time-consuming for large accounts, as acknowledged with the '--without-import' flag to skip this step.
Requires direct IAM privileges during execution and replaces hardcoded values with Terraform references, which may cause resource replacements and unintended modifications if not carefully managed.