Iam Policy Autopilot, from Awslabs, is a free, open-source static code analysis tool designed for AWS builders. Built with Python, it helps create and manage identity-based AWS IAM policies directly from application code. The tool analyzes AWS SDK calls to automatically generate baseline policies and assists in resolving access denied issues. It functions as both a command-line utility and an MCP server, integrating with various AI coding assistants. Its primary goal is to simplify IAM policy creation and debugging for developers, product managers, and technical experimenters working on the AWS platform. This platform-agnostic tool aids in enhancing cloud security posture and development efficiency.

What does Iam Policy Autopilot connect to?

Iam Policy Autopilot connects directly to AWS Identity and Access Management (IAM) to perform its core functions. It analyzes AWS SDK calls embedded within application code to generate identity-based policies. This connection enables the tool to understand the necessary permissions for an application based on its operational logic. Furthermore, the tool is designed to integrate with several AI clients, including Kiro, Amazon Q Developer, Cursor, Cline, Claude Code, and Gemini, extending its utility into AI-assisted development workflows. It supports stdio and streamable HTTP for transport.

Core features and tools

Iam Policy Autopilot operates as a command-line utility via the "iam-policy-autopilot" command and as an MCP server. Its MCP server exposes specific callable tools to extend its functionality. Key among these are generate-policies, which creates identity-based IAM policies from application code analysis, and fix_access_denied, designed to analyze "Access Denied" errors and propose targeted policy additions. The tool's static code analysis capabilities form the foundation for these policy generation and troubleshooting features, making it a valuable developer tool for auth security.

Who is it for?

Iam Policy Autopilot targets builders on AWS, encompassing developers, product managers, technical experimenters, and business leaders. It is particularly valuable for those who utilize AI coding assistants in their development process. The tool helps these users automate the creation of IAM policies and diagnose access-related issues efficiently. Its focus on static code analysis benefits anyone needing to secure AWS resources based on application behavior. Skip this if you do not work with AWS or require IAM policy generation and troubleshooting.

How to get started

No credentials are required for Iam Policy Autopilot itself, as it performs local static code analysis. It supports the stdio transport protocol for local execution and streamable HTTP for its MCP server.

Use cases

• Generating baseline identity-based IAM policies from application code.
• Integrating with AI coding assistants to automatically create IAM policies during development.
• Troubleshooting "Access Denied" errors by analyzing denials and proposing targeted policy additions.

Iam Policy Autopilot offers a practical approach to managing AWS IAM policies through static code analysis. Developed by Awslabs, it simplifies policy generation and access error resolution for AWS builders. Its integration with AI coding assistants positions it as a key tool for modern cloud development security practices. The tool's ability to operate without AWS credentials for its analysis makes it easy to incorporate into various workflows. Try generating baseline identity-based IAM policies from your application code using the "generate-policies" tool.