terraform-iam-policy-validator
A CLI tool that validates AWS IAM policies in Terraform templates against AWS IAM best practices and custom checks.
What is terraform-iam-policy-validator?
IAM Policy Validator for Terraform is a command-line tool that analyzes AWS IAM policies defined in Terraform templates. It validates these policies against AWS IAM best practices using IAM Access Analyzer, helping identify security misconfigurations before deploying infrastructure. The tool supports both standard policy checks and custom checks for specific security requirements.
DevOps engineers, security engineers, and cloud infrastructure developers who use Terraform to manage AWS resources and need to ensure IAM policies follow security best practices.
Developers choose this tool because it integrates AWS's native IAM analysis directly into Terraform workflows, providing automated security validation that catches policy issues early. It offers granular control over validation rules and supports custom security checks beyond standard best practices.
Overview
A command line tool that validates AWS IAM Policies in a Terraform template against AWS IAM best practices
Use Cases
Best For
- Validating IAM policies in Terraform templates before deployment
- Checking for public access in S3 bucket policies defined as code
- Ensuring IAM roles don't grant excessive permissions in infrastructure
- Comparing new IAM policies against existing reference policies for access changes
- Preventing deployment of Terraform code with critical security findings
- Integrating IAM security validation into CI/CD pipelines for AWS infrastructure
Not Ideal For
- Projects using non-AWS cloud providers or multi-cloud Terraform configurations
- Terraform templates that heavily rely on computed resources for IAM policy definitions
- Organizations with strict budgets avoiding AWS service charges for custom policy checks
- Environments requiring offline IAM policy validation without AWS API dependencies
Pros & Cons
Pros
Uses AWS IAM Access Analyzer directly, providing up-to-date security checks aligned with AWS best practices and reducing manual policy review.
Supports custom checks for new access, critical permissions, and public access via IAM Access Analyzer, enabling tailored security policies beyond standard validation.
Parses IAM policies from Terraform plan JSON files, allowing validation early in the development cycle without deploying resources.
Offers configurable blocking findings and ignore rules by code or resource, minimizing false positives and enabling flexible enforcement in CI/CD.
Cons
Custom policy checks incur AWS charges per validation, as highlighted in the README, which can become significant for large or frequent deployments.
Fails to validate policies with Terraform computed resources, a admitted limitation that leaves a security blind spot for dynamic IAM configurations.
Relies entirely on AWS IAM Access Analyzer APIs, requiring consistent network access, proper permissions, and subjecting validation to AWS service availability and rate limits.
Frequently Asked Questions
Related Projects
terraformerCLI tool to generate terraform files from existing infrastructure (reverse Terraform). Infrastructure to Code
InfracostCloud cost intelligence for engineers, AI coding agents, and CI/CD 💰📉 Shift FinOps Left!
TerragruntTerragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu/Terraform to scale.
atlantisTerraform Pull Request Automation
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.