{"id":27261511,"url":"https://github.com/coldbootsec/secure-iam-lint","last_synced_at":"2026-05-04T07:37:18.320Z","repository":{"id":287235023,"uuid":"963608377","full_name":"coldbootsec/secure-iam-lint","owner":"coldbootsec","description":"Scan your IAM policies before they hit prod. secure-iam-lint catches common misconfigurations with a simple CLI or CI step","archived":false,"fork":false,"pushed_at":"2025-04-10T16:44:47.000Z","size":14,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-10T18:05:47.134Z","etag":null,"topics":["aws","ci-cd","cloud","compliance","devsecops","iam","linter","python","security","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/coldbootsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-04-10T00:06:13.000Z","updated_at":"2025-04-10T16:44:51.000Z","dependencies_parsed_at":"2025-04-10T18:05:49.914Z","dependency_job_id":"3595ea0a-3f29-42bf-ab31-508481a0ee84","html_url":"https://github.com/coldbootsec/secure-iam-lint","commit_stats":null,"previous_names":["coldbootsec/secure-iam-lint"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coldbootsec%2Fsecure-iam-lint","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coldbootsec%2Fsecure-iam-lint/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coldbootsec%2Fsecure-iam-lint/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/coldbootsec%2Fsecure-iam-lint/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/coldbootsec","download_url":"https://codeload.github.com/coldbootsec/secure-iam-lint/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248347874,"owners_count":21088759,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","ci-cd","cloud","compliance","devsecops","iam","linter","python","security","static-analysis"],"created_at":"2025-04-11T05:33:49.556Z","updated_at":"2026-05-04T07:37:18.285Z","avatar_url":"https://github.com/coldbootsec.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# secure-iam-lint\n\n**Scan your IAM policies before they hit prod.**  \n`secure-iam-lint` catches common misconfigurations in AWS IAM policies with a simple CLI or CI step.\n\n## Why\n\nOverly permissive IAM policies are one of the most common and dangerous misconfigurations in AWS environments. This tool helps identify risky patterns before they're deployed, keeping your infrastructure secure by default.\n\n## How It Works\n\n```mermaid\ngraph TD\n    A[Developer writes IAM policy] --\u003e B[Run secure-iam-lint]\n    B --\u003e C{Policy safe?}\n    C -- Yes --\u003e D[Deploy to AWS]\n    C -- No --\u003e E[Fail pipeline or warn developer]\n```\n\n## Install\n\nFor now:\n\n```bash\ngit clone https://github.com/coldbootsec/secure-iam-lint.git\ncd secure-iam-lint\npython3 -m venv .venv \u0026\u0026 source .venv/bin/activate\npip install .\n```\n\nComing soon:\n\n```bash\npip install secure-iam-lint  # coming soon\n```\n\n## Usage\n\n```bash\niam-lint examples/bad-policy.json\n```\n\n## Example Output\n\n```\n[!] Findings:\n - Statement 0: Action includes '*' (overly permissive)\n - Statement 0: Resource includes '*' (overly permissive)\n - Statement 0: Allow without any Condition block\n - Statement 1: Allow without any Condition block\n - Statement 1: Uses sts:AssumeRole with wildcard\n - Statement 1: Grants iam:PassRole without Conditions\n```\n\n## Current Rules\n\n| Rule                             | Description                                  |\n|----------------------------------|----------------------------------------------|\n| `*` in Action or Resource        | Detects wildcard permissions                 |\n| Allow without Condition          | Warns on unconditional access                |\n| Privilege Escalation Patterns    | Detects dangerous combinations (e.g. PassRole + wildcard) |\n| sts:AssumeRole with Wildcard     | Flags open trust policies                    |\n\n## CI Integration\n\n```yaml\n- name: Lint IAM policies\n  run: |\n    pip install .\n    iam-lint path/to/policies/\n```\n\n## Examples\n\nSee [`examples/bad-policy.json`](examples/bad-policy.json) and [`examples/escalation-risk.json`](examples/escalation-risk.json) for policy samples that trigger linter warnings.\n\n## Project Structure\n\n```text\nsecure-iam-lint/\n├── iamlint/\n│   ├── __init__.py\n│   ├── cli.py\n│   └── rules.py\n├── examples/\n│   ├── bad-policy.json\n│   └── escalation-risk.json\n├── tests/\n│   └── test_rules.py\n├── iam_lint.py\n├── setup.py\n└── README.md\n```\n\n## Contributing\n\nIssues and pull requests are welcome. Open a discussion if you have an idea for a new rule.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoldbootsec%2Fsecure-iam-lint","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcoldbootsec%2Fsecure-iam-lint","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcoldbootsec%2Fsecure-iam-lint/lists"}