{"repo":"awslabs/aws-cloudformation-iam-policy-validator","free":true,"listed":false,"github":"https://github.com/awslabs/aws-cloudformation-iam-policy-validator","clone":"git clone https://github.com/awslabs/aws-cloudformation-iam-policy-validator.git","description":null,"language":"Python","stars":146,"topics":["aws","aws-iam","aws-iam-policies","cloudformation"],"license":"MIT-0","category":"deployment-docker-iac","readme_excerpt":"IAM Policy Validator for AWS CloudFormation A command line tool that takes a CloudFormation template, parses the IAM policies attached to IAM roles, users, groups, and resources then runs them through IAM Access Analyzer for basic policy validation checks and for custom policy checks. Note that a charge is associated with each custom policy check. For more details about pricing, see IAM Access Analyzer pricing. Getting Started Installation: Python 3.9+ is supported. Basic usage: Interactive workshop that walks through use of the cfn-policy-validator tool in a CI/CD pipeline: https://workshops.aws/card/Integrating%20IAM%20Access%20Analyzer Why do I need the IAM Policy Validator for AWS CloudFormation? The cfn-policy-validator is designed to prevent the deployment of unwanted IAM identity-based and resource-based policies to your AWS environment. CloudFormation templates commonly use intrinsic functions in templates that create least privilege IAM policies. Take a look at the template below which creates an SQS queue with an attached SQS queue policy. Extracting the queue policy from this template as is would not give you a valid IAM policy. The line Fn:GetAtt: [\"MyQueue\", \"Arn\"] is not valid IAM policy syntax - this is syntax specific to CloudFormation. The IAM Policy Validator for AWS CloudFormation (cfn-policy-validator) evaluates these intrinsic functions, like Fn:GetAtt, substituting similar or identical values to what you will get when you deploy the template. This allows","default_branch":null,"files":null,"tree":[],"storefront":"/r/awslabs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/awslabs/aws-cloudformation-iam-policy-validator/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}