A CLI tool that validates AWS IAM policies in Terraform templates against AWS IAM best practices and custom checks.
IAM Policy Validator for Terraform is a command-line tool that analyzes AWS IAM policies defined in Terraform templates. It validates these policies against AWS IAM best practices using IAM Access Analyzer, helping identify security misconfigurations before deploying infrastructure. The tool supports both standard policy checks and custom checks for specific security requirements.
DevOps engineers, security engineers, and cloud infrastructure developers who use Terraform to manage AWS resources and need to ensure IAM policies follow security best practices.
Developers choose this tool because it integrates AWS's native IAM analysis directly into Terraform workflows, providing automated security validation that catches policy issues early. It offers granular control over validation rules and supports custom security checks beyond standard best practices.
A command line tool that validates AWS IAM Policies in a Terraform template against AWS IAM best practices
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses AWS IAM Access Analyzer directly, providing up-to-date security checks aligned with AWS best practices and reducing manual policy review.
Supports custom checks for new access, critical permissions, and public access via IAM Access Analyzer, enabling tailored security policies beyond standard validation.
Parses IAM policies from Terraform plan JSON files, allowing validation early in the development cycle without deploying resources.
Offers configurable blocking findings and ignore rules by code or resource, minimizing false positives and enabling flexible enforcement in CI/CD.
Custom policy checks incur AWS charges per validation, as highlighted in the README, which can become significant for large or frequent deployments.
Fails to validate policies with Terraform computed resources, a admitted limitation that leaves a security blind spot for dynamic IAM configurations.
Relies entirely on AWS IAM Access Analyzer APIs, requiring consistent network access, proper permissions, and subjecting validation to AWS service availability and rate limits.