Pike determines the minimum IAM permissions required to run OpenTofu/Terraform infrastructure code.
Pike is a tool that analyzes OpenTofu/Terraform code to determine the exact IAM permissions required to deploy cloud infrastructure. It solves the problem of over-permissive cloud access by generating minimum-required policies directly from Infrastructure as Code, helping teams implement least-privilege security.
Cloud engineers, DevOps teams, and security professionals managing Infrastructure as Code who need to enforce least-privilege IAM policies across AWS, GCP, or Azure environments.
Developers choose Pike because it automates the tedious process of manually calculating IAM permissions, reduces security risks from over-permissive policies, and integrates directly into existing Terraform/OpenTofu workflows with multi-cloud support.
Pike is a tool for determining the permissions or policy required for IAC code
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Automatically scans OpenTofu/Terraform code to list required IAM actions for AWS, GCP, and Azure, eliminating manual calculation as demonstrated in the scan command outputs.
Compares IaC requirements against deployed IAM roles to identify permission gaps or over-permissions, useful for auditing with the compare command's diff output.
Can create and attach IAM policies/roles directly in AWS using the 'make' command, returning ARNs for testing, as shown in the usage examples.
Updates READMEs with policy documentation via the 'readme' command and triggers GitHub Actions with temporary credentials using 'remote' and 'invoke', enhancing automation.
Generates policies with wild-carded resources and no conditions, requiring manual refinement for least-privilege best practices, as admitted in the CAVEAT section.
Some GCP resources have unvalidated permissions marked as placeholders due to lack of empirical testing, reducing accuracy for organization-level deployments.
Direct deployment and advanced features like 'inspect' are primarily available for AWS, making GCP and Azure support less mature and functional.