by awslabs
IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.
# Add to your Claude Code skills
git clone https://github.com/awslabs/iam-policy-autopilotAn open source Model Context Protocol (MCP) server and command-line tool that helps your AI coding assistants quickly create baseline IAM policies that you can refine as your application evolves, so you can build faster. IAM Policy Autopilot analyzes your application code locally to generate identity-based policies for application roles, enabling faster IAM policy creation and reducing access troubleshooting time. IAM Policy Autopilot supports policy generation for applications built in Python, Go, TypeScript, JavaScript, and Java — see Supported Languages and SDKs for policy generation.
We want to hear from you. Ask questions or share ideas in Discussions, report bugs through Issues, or contribute directly with a Pull Request.
No comments yet. Be the first to share your thoughts!
IAM Policy Autopilot is for builders on AWS using AI coding assistants, including developers, product managers, technical experimenters, and business leaders.
IAM Policy Autopilot is:
IAM Policy Autopilot accelerates development by generating baseline identity-based IAM policies. Your AI coding assistant can call IAM Policy Autopilot to analyze AWS SDK calls within your application. IAM Policy Autopilot then automatically creates the baseline IAM permissions for your application roles.
IAM Policy Autopilot's deterministic code analysis helps create reliable and valid IAM policies that reduce policy troubleshooting. By using valid policies created with the MCP server, you reduce time spent on policy-related debugging and accelerate application deployment by avoiding permission-related delays.
IAM Policy Autopilot stays up to date with the latest AWS services and features so that builders and coding assistants have access to the latest AWS IAM permissions knowledge. It helps keep your application role's permissions current with AWS's evolving capabilities.
IAM Policy Autopilot generates baseline policies to provide a starting point that you can refine as your application matures. Review the generated policies to ensure they align with your security requirements before deploying them. Use the --explain feature with action patterns (e.g., --explain 's3:*') to understand which operations led to an action being included in the generated policies.
IAM Policy Autopilot produces IAM identity-based policies, but doesn't support resource-based policies such as S3 bucket policies or KMS key policies, Resource Control Policies (RCPs), Service Control Policies (SCPs), and permission boundaries. These are the limitations that you need to keep in mind. For example, if your code calls s3.getObject(bucketName) where bucketName is determined at runtime, IAM Policy Autopilot currently doesn't predict which bucket will be accessed.
IAM Policy Autopilot generates policies with specific actions based on deterministic analysis of your code. When you use the MCP server integration, your AI coding assistant receives this policy and might modify it when creating infrastructure-as-code templates. For example, you might see the assistant add specific resource Amazon Resource Names (ARNs) or include KMS key IDs based on additional context from your code. These changes come from your coding assistant's interpretation of your broader code context, not from the static analysis provided by IAM Policy Autopilot. Always review content generated by your coding assistant before deployment to verify that it meets your security requirements.
IAM Policy Autopilot's static analysis may include permissions for AWS services your application doesn't use. This happens when method names in your code match AWS SDK calls from multiple services. For example, a method called listAccounts() might generate permissions for both AWS Organizations and Amazon Chime services.
Recommended approach: Use the --service-hints option to specify only the AWS services your application actually uses. This helps IAM Policy Autopilot scope down which SDK calls to analyze, but the final policy may still include actions from other services if they're required by the operations you perform:
# More accurate - specify only services you use
iam-policy-autopilot generate-policies ./src/app.py --service-hints s3 iam organizations --pretty
# Less accurate - may include unnecessary permissions
iam-policy-autopilot generate-policies ./src/app.py --pretty
This significantly reduces unnecessary permissions and generates more targeted policies. Note that the final policy may still include actions from services not in your hints if they're required for the operations you perform (e.g., KMS actions for S3 encryption).
Note: When using the MCP server integration with AI coding assistants, the assistant is expected to automatically provide appropriate service hints based on your code context. The --service-hints option is primarily for CLI usage.
| Language | SDK | |---|---| | Go | AWS SDK for Go v2 | | Java | AWS SDK for Java v2 | | JavaScript | AWS SDK for JavaScript v3 | | TypeScript | AWS SDK for JavaScript v3 | | Python | Boto3, Botocore |
Install uv from Astral.
No additional installation needed - you can run IAM Policy Autopilot directly using uvx iam-policy-autopilot.
Install pip.
pip install iam-policy-autopilot
To install the latest release directly, run the following script to download and install as a system utility.
curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh | sudo sh
This will install the latest release directly to /usr/local/bin/iam-policy-autopilot.
IAM Policy Autopilot requires AWS credentials to apply policy fixes and upload policies for AccessDenied debugging.
Install AWS CLI and configure your AWS credentials.
For more information on AWS credential configuration, see the AWS CLI Configuration Guide.
Configure the MCP server in your MCP client configuration to enable your AI coding assistant to generate IAM policies.
Get Kiro from https://kiro.dev/
If using uv/uvx:
Add the following configuration to your project-level .kiro/settings/mcp.json:
{
"mcpServers": {
"iam-policy-autopilot": {
"command": "uvx",
"args": ["iam-policy-autopilot", "mcp-server"],
"env": {
"AWS_PROFILE": "your-profile-name",
"AWS_REGION": "us-east-1"
},
"disabled": false,
"autoApprove": []
}
}
}
If using pip:
{
"mcpServers": {
"iam-policy-autopilot": {
"command": "iam-policy-autopilot",
"args": ["mcp-server"],
"env": {
"AWS_PROFILE": "your-profile-name",
"AWS_REGION": "us-east-1"
},
"disabled": false,
"autoApprove": []
}
}
}
Get Kiro CLI from https://kiro.dev/cli
Kiro Cli uses the same configuration as Kiro mentioned above, additionally, MCPs for Kiro CLI can also be setup via:
If using uv/uvx:
kiro-cli mcp add \
--name iam-policy-autopilot \
--command "uvx" \
--args "iam-policy-autopilot","mcp-server"
If using pip:
kiro-cli mcp add \
--name iam-policy-autopi