agentsclimarketplace
Sign in

Iam policy validator

Skill boogy/iam-policy-validator/skills/iam-policy-validator

Validate, analyze, and query AWS IAM policies with the iam-policy-validator CLI, and export findings as JSON for a second agent to verify and post to a GitHub PR. Use when checking, validating, linting, or auditing IAM identity, resource, or trust policies, SCPs, or RCPs; when the user mentions wildcard actions, privilege escalation, sensitive actions, confused deputy, or overly permissive policies; when querying which AWS actions, condition keys, or ARNs a service supports (or which actions support a condition key); when running AWS IAM Access Analyzer; or when exporting SARIF/Markdown/HTML/JSON findings for PR review. CLI-based alternative to the MCP server.From its SKILL.md

Install
npx -y skills add boogy/iam-policy-validator --skill iam-policy-validator

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

7.3 KB, as published. Nobody here has run it

IAM Policy Validator (CLI)

Validate AWS IAM policies against 22 built-in checks and query AWS service definitions. Self-contained: needs only the CLI (uvx, no install) plus Python 3.10+.

Home: https://github.com/boogy/iam-policy-validator · Docs: https://boogy.github.io/iam-policy-validator/

What do you need to do?

GoalCommand
Validate a policy file or directoryiam-validator validate --path <path>
Validate and post findings to a PRvalidate --format json -> verify -> post-to-pr (see below)
Query AWS actions, ARNs, conditionsiam-validator query action|arn|condition --service <svc>
Run AWS IAM Access Analyzeriam-validator analyze --path <path>
Manage the AWS service cacheiam-validator cache info|clear|refresh|prefetch
Pre-download for offline/CIiam-validator sync-services --output-dir ./aws_services/
Generate shell completionsiam-validator completion bash|zsh

Quickstart

# Scan one file (no install needed)
uvx iam-policy-validator validate --path policy.json

# Scan a directory recursively
uvx iam-policy-validator validate --path ./policies/

# Trust policy (auto-detect works, but explicit is safer)
uvx iam-policy-validator validate --path trust.json --policy-type TRUST_POLICY

# JSON output for scripting or PR handoff
uvx iam-policy-validator validate --path ./policies/ --format json --output findings.json

Invocation arguments

Skill argumentMaps to CLI
validate (default)iam-validator validate --path <path>
queryiam-validator query ... — see references/querying.md
analyzeiam-validator analyze --path <path> (AWS IAM Access Analyzer)
--config <file>--config <file> (forwarded verbatim; YAML)
--export-json <file>--format json --output <file>, then hand off — do NOT post

Defaults: no verb -> validate. With --export-json, follow the PR handoff and never post comments directly.

Install / run

uvx iam-policy-validator validate --path policy.json   # preferred, no install
uv add iam-policy-validator        # or: pip install iam-policy-validator
iam-validator --version

Do not install the [mcp] extra — this skill is CLI-only.

PR workflow (two options)

Option 1: Native post-to-pr (simpler)

iam-validator validate --path ./policies/ --format json --output report.json
iam-validator post-to-pr --report report.json

Posts all findings. Good for CI where you trust the validator's output. See references/ci-integration.md.

Option 2: JSON handoff with verification (recommended for agents)

# 1. Export findings
iam-validator validate --path ./policies/ --format json --output findings.json

# 2. Verify each finding with query (see verification-protocol.md)
iam-validator query action --name <svc:Action> --has-condition-key <key>

# 3. Render verified findings
python3 scripts/render_pr_comments.py findings.json --format json > comments.json

# 4. Post from a separate agent

Full protocol: references/pr-review-handoff.md. Verification checklist: references/verification-protocol.md.

Exit codes

CodeMeaning
0No error-severity findings (warnings may still exist)
non-zeroError-severity findings, or --fail-on-warnings + warnings, or CLI error

Read stderr and findings before drawing conclusions. A non-zero exit does not necessarily mean the policy is dangerous.

Policy types

IDENTITY_POLICY (default), RESOURCE_POLICY, TRUST_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY — auto-detected when --policy-type is omitted. Pass it explicitly for trust, resource, SCP, or RCP documents to avoid false positives.

References

For authoritative per-check detail, see https://boogy.github.io/iam-policy-validator/user-guide/checks/ rather than inventing specifics.

Guardrails

  • Verify flags with iam-validator <cmd> --help; don't fabricate them.
  • Show findings before editing a user's policy; don't silently rewrite.
  • Prefer uvx over global installs; ask before changing the environment.
  • Don't invent findings — if the validator reports 0 issues, the policy is clean.
  • Don't invent check IDs — use only the 22 IDs from checks.md.
  • Verify before posting — for PRs, follow verification-protocol.md.
  • Use --policy-type for non-identity policies to avoid false positives.
  • Read common-mistakes.md for the full list of agent pitfalls.

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.