AWS IAM Identity Policy Risk Reviewer

{
  "type": "json",
  "example": {
    "label": "paid-demo:administrator-and-passrole",
    "stats": {
      "policy_bytes": 253,
      "string_count": 21,
      "statement_count": 2,
      "tree_node_count": 16,
      "deny_statement_count": 0,
      "findings_by_severity": {
        "low": 0,
        "high": 4,
        "medium": 5,
        "critical": 3
      },
      "action_selector_count": 4,
      "allow_statement_count": 2,
      "resource_selector_count": 2,
      "broad_allow_statement_count": 2
    },
    "profile": "production",
    "summary": "BLOCK: 12 finding(s) across 2 statement(s); 7 require resolution or explicit approval.",
    "verdict": "BLOCK",
    "coverage": {
      "mode": "static-aws-iam-json-policy",
      "checks": [
        "IAM policy grammar and element combinations",
        "least-privilege action and resource scope",
        "public, service, cross-account, and federated principals",
        "sensitive condition wildcarding",
        "PassRole and workload-creation escalation chains",
        "credential, secret, key, and organization permissions",
        "MFA and transport guardrails"
      ],
      "limitations": [
        "Does not evaluate identity, resource, boundary, session, SCP, and RCP policies together.",
        "Does not know which principals, resources, tags, organization paths, or identity-provider claims exist in the target account.",
        "Does not replace IAM Access Analyzer validation, custom policy checks, policy simulation, or CloudTrail-based least-privilege refinement."
      ],
      "policy_simulated": false,
      "aws_api_contacted": false,
      "credentials_loaded": false,
      "condition_values_returned": false
    },
    "findings": [
      {
        "code": "allow_all_actions",
        "path": "Statement[0].Action",
        "message": "The statement grants every AWS action.",
        "severity": "critical",
        "standard": "aws-iam-least-privilege",
        "remediation": "Replace * with the smallest task-specific action allowlist."
      },
      {
        "code": "passrole_deployment_escalation_chain",
        "path": "Statement[0].Action",
        "message": "The statement combines PassRole with a workload-creation action that can execute as another role.",
        "severity": "critical",
        "standard": "aws-iam-privilege-escalation",
        "remediation": "Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions."
      },
      {
        "code": "passrole_deployment_escalation_chain",
        "path": "Statement[1].Action",
        "message": "The statement combines PassRole with a workload-creation action that can execute as another role.",
        "severity": "critical",
        "standard": "aws-iam-privilege-escalation",
        "remediation": "Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions."
      },
      {
        "code": "passrole_all_resources",
        "path": "Statement[0].Resource",
        "message": "iam:PassRole can target every role.",
        "severity": "high",
        "standard": "aws-iam-passrole",
        "remediation": "Restrict Resource to approved execution roles and add iam:PassedToService."
      },
      {
        "code": "wildcard_resource",
        "path": "Statement[0].Resource",
        "message": "The allow statement applies to every resource.",
        "severity": "high",
        "standard": "aws-iam-least-privilege",
        "remediation": "Scope Resource to exact ARNs and use conditions only as a secondary boundary."
      },
      {
        "code": "passrole_all_resources",
        "path": "Statement[1].Resource",
        "message": "iam:PassRole can target every role.",
        "severity": "high",
        "standard": "aws-iam-passrole",
        "remediation": "Restrict Resource to approved execution roles and add iam:PassedToService."
      },
      {
        "code": "wildcard_resource",
        "path": "Statement[1].Resource",
        "message": "The allow statement applies to every resource.",
        "severity": "high",
        "standard": "aws-iam-least-privilege",
        "remediation": "Scope Resource to exact ARNs and use conditions only as a secondary boundary."
      },
      {
        "code": "partial_action_wildcard",
        "path": "Statement[0].Action",
        "message": "The statement uses wildcard action patterns whose future match set can expand.",
        "severity": "medium",
        "standard": "aws-iam-least-privilege",
        "remediation": "Prefer explicit action names or tightly review the wildcard pattern and service evolution."
      },
      {
        "code": "passrole_missing_service_boundary",
        "path": "Statement[0].Condition",
        "message": "iam:PassRole is not constrained to an intended destination service.",
        "severity": "medium",
        "standard": "aws-iam-passrole",
        "remediation": "Add an iam:PassedToService condition and an exact role ARN allowlist."
      },
      {
        "code": "privileged_action_without_mfa_condition",
        "path": "Statement[0].Condition",
        "message": "Production privilege-management actions have no policy-level MFA condition.",
        "severity": "medium",
        "standard": "aws-iam-mfa-best-practice",
        "remediation": "Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."
      },
      {
        "code": "passrole_missing_service_boundary",
        "path": "Statement[1].Condition",
        "message": "iam:PassRole is not constrained to an intended destination service.",
        "severity": "medium",
        "standard": "aws-iam-passrole",
        "remediation": "Add an iam:PassedToService condition and an exact role ARN allowlist."
      },
      {
        "code": "privileged_action_without_mfa_condition",
        "path": "Statement[1].Condition",
        "message": "Production privilege-management actions have no policy-level MFA condition.",
        "severity": "medium",
        "standard": "aws-iam-mfa-best-practice",
        "remediation": "Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."
      }
    ],
    "risk_score": 100,
    "statements": [
      {
        "sid": "AdministratorAccess",
        "index": 0,
        "effect": "Allow",
        "action_count": 1,
        "service_names": [],
        "resource_count": 1,
        "principal_count": 0,
        "principal_types": [],
        "uses_not_action": false,
        "uses_not_resource": false,
        "condition_key_count": 0
      },
      {
        "sid": "DeployAsAnyRole",
        "index": 1,
        "effect": "Allow",
        "action_count": 3,
        "service_names": [
          "iam",
          "lambda",
          "secretsmanager"
        ],
        "resource_count": 1,
        "principal_count": 0,
        "principal_types": [],
        "uses_not_action": false,
        "uses_not_resource": false,
        "condition_key_count": 0
      }
    ],
    "analysis_id": "iam-cc3bf126a64835168c71",
    "policy_type": "identity",
    "approval_gates": [
      "Resolve or explicitly approve 7 critical/high policy finding(s) before attachment or deployment.",
      "Prove the necessity and effective boundary of 2 broad allow statement(s) with IAM Access Analyzer or policy simulation in the target account.",
      "Confirm that PassRole is restricted to approved role ARNs and destination services and cannot form a workload-creation escalation chain."
    ],
    "analyzer_version": "iamguard-aws-policy/1.0"
  }
}