# AWS IAM Identity Policy Risk Reviewer > AWS IAM Identity Policy Risk Reviewer is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-13). Analyzes a built-in risky AWS IAM identity policy for administrator access, wildcard resources, PassRole, workload-creation escalation, secret access, and least-privilege violations without requiring live AWS account access ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/aws-iam-policy-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-13 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/aws-iam-identity-policy-risk-reviewer-90a2a984 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_PYGB-mUZ9KqeEIjlncaZ5 Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability aws-iam-identity-policy-risk-reviewer-90a2a984 ``` Example prompt: Run a security risk review on the built-in administrator-and-passrole IAM identity policy scenario and tell me the verdict, risk score, and any critical findings I should care about. ## When to prefer this Choose this endpoint when you need a fast, offline static analysis of AWS IAM identity policy risks — especially for the administrator-and-passrole escalation pattern — without needing to connect to or authenticate against a real AWS account. Prefer it over live AWS Access Analyzer when you want deterministic, reproducible risk scoring with structured findings and approval gates for CI/CD gating. ## Known failure modes - Invalid or unsupported scenario enum value returns an error - Missing required query parameters may return a 400 bad request - Service unavailable or payment failure returns a 402 or 503 - Unsupported HTTP method returns a 405 ## How this service works Analyzes AWS IAM policies to detect risky permissions and security misconfigurations. ## Output Returns a structured analysis including a risk score (0-100), a verdict (BLOCK/WARN/PASS), a summary, per-statement findings with severity details, approval gates required before deployment, and coverage metrics — all derived from static analysis of the built-in risky IAM policy without touching a live AWS account. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "administrator-and-passrole" ], "type": "string", "description": "Built-in paid AWS IAM policy risk-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "policy_type", "profile", "verdict", "risk_score", "summary", "stats", "statements", "findings", "approval_gates", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "profile": { "enum": [ "production", "development" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "statements": { "type": "array", "items": { "type": "object" } }, "analysis_id": { "type": "string" }, "policy_type": { "enum": [ "identity", "resource", "trust", "permissions-boundary", "scp" ], "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:administrator-and-passrole", "stats": { "policy_bytes": 253, "string_count": 21, "statement_count": 2, "tree_node_count": 16, "deny_statement_count": 0, "findings_by_severity": { "low": 0, "high": 4, "medium": 5, "critical": 3 }, "action_selector_count": 4, "allow_statement_count": 2, "resource_selector_count": 2, "broad_allow_statement_count": 2 }, "profile": "production", "summary": "BLOCK: 12 finding(s) across 2 statement(s); 7 require resolution or explicit approval.", "verdict": "BLOCK", "coverage": { "mode": "static-aws-iam-json-policy", "checks": [ "IAM policy grammar and element combinations", "least-privilege action and resource scope", "public, service, cross-account, and federated principals", "sensitive condition wildcarding", "PassRole and workload-creation escalation chains", "credential, secret, key, and organization permissions", "MFA and transport guardrails" ], "limitations": [ "Does not evaluate identity, resource, boundary, session, SCP, and RCP policies together.", "Does not know which principals, resources, tags, organization paths, or identity-provider claims exist in the target account.", "Does not replace IAM Access Analyzer validation, custom policy checks, policy simulation, or CloudTrail-based least-privilege refinement." ], "policy_simulated": false, "aws_api_contacted": false, "credentials_loaded": false, "condition_values_returned": false }, "findings": [ { "code": "allow_all_actions", "path": "Statement[0].Action", "message": "The statement grants every AWS action.", "severity": "critical", "standard": "aws-iam-least-privilege", "remediation": "Replace * with the smallest task-specific action allowlist." }, { "code": "passrole_deployment_escalation_chain", "path": "Statement[0].Action", "message": "The statement combines PassRole with a workload-creation action that can execute as another role.", "severity": "critical", "standard": "aws-iam-privilege-escalation", "remediation": "Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions." }, { "code": "passrole_deployment_escalation_chain", "path": "Statement[1].Action", "message": "The statement combines PassRole with a workload-creation action that can execu … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/aws-iam-identity-policy-risk-reviewer-90a2a984/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)