aws iam policy risk analyzer

*Find privilege-escalation action combinations, Allow , unrestricted PassRole and risky OIDC trust in IAM policy dumps — offline.

Analyze AWS IAM policies and account authorization dumps offline for privilege-escalation action combinations (Rhino Labs methods), Allow * / Resource *, NotAction+Allow, unrestricted PassRole, public or cross-account role trust, and GitHub OIDC trust missing the sub claim. Reads aws iam get-account-authorization-details JSON or individual policy files and writes a severity-ranked report plus CSV. Use when someone asks "is this IAM policy safe?", "find privilege escalation in our account" or "review our GitHub OIDC role".

What it does

• Runs entirely offline in standard-library Python (no network, no credentials, writes only inside the working folder).
• Ships with examples, unit tests (run on Python 3.8 / 3.9 / 3.13) and a references/sources.md citing the official specs used.
• Exit codes: 0 = clean / aligned, 1 = findings, 2 = bad input — ready for CI and agent loops.

Who it's for

Security-minded developers, MSPs, small-business IT, compliance leads and IR analysts who want a repeatable offline check their agent can run.

Not legal advice / limits

See the skill's references/sources.md and Known Limitations below. Compliance-flavored output is a draft for counsel, not a certification.