awslabs/iam-policy-autopilot

IAM Policy Autopilot is an open source static code analysis tool that helps you quickly create baseline AWS IAM policies that you can refine as your application evolves. This tool is available as a command-line utility and MCP server for use within AI coding assistants for quickly building IAM policies.

What it solves

IAM Policy Autopilot helps developers avoid the tedious and error-prone process of manually writing AWS Identity and Access Management (IAM) policies. It reduces the time spent troubleshooting "AccessDenied" errors and accelerates application deployment by automatically generating baseline permissions based on the actual AWS SDK calls found in the application's code.

How it works

The tool uses deterministic static analysis of source code to identify AWS SDK calls and map them to the required IAM permissions. It can be used as a standalone command-line interface (CLI) or as a Model Context Protocol (MCP) server, allowing AI coding assistants to trigger policy generation directly within the IDE.

It supports several workflows:

  • Code Analysis: Analyzes Python, Go, Java, TypeScript, and JavaScript code to generate policies.
  • Terraform Integration: Generates policies from JSON-formatted Terraform plan files.
  • Error Fixing: Parses specific AWS "AccessDenied" error messages to suggest or apply policy fixes.

Who it’s for

AWS builders, including developers, product managers, and technical experimenters who use AI coding assistants to build and deploy applications on AWS.

Highlights

  • AI Assistant Integration: Functions as an MCP server, enabling AI agents to generate IAM policies based on the user's code context.
  • Multi-language Support: Works with the AWS SDKs for Python (Boto3/Botocore), Go, Java, and JavaScript/TypeScript.
  • Deterministic Analysis: Uses static code analysis rather than guessing, ensuring policies are valid and reliable.
  • Service Hints: Allows users to specify which AWS services are actually used to reduce unnecessary permissions.
  • AccessDenied Debugging: Can take an error message as input to automatically fix permission issues.

Related

  • Project
    aws/agent-toolkit-for-aws

    A toolkit that provides AI coding agents with the tools, knowledge, and guardrails needed to build, deploy, and manage applications on AWS.

  • Project
    awslabs/mcp

    Open‑source MCP (Model Context Protocol) servers that let LLM‑powered tools fetch live AWS documentation, IaC guidance, and safely invoke AWS APIs. Includes managed remote servers and local binaries for docs, IaC, EKS, etc., all accessed via a stdio‑based protocol.

  • Project
    aws/mcp-proxy-for-aws

    A bridge that enables AI applications and agents to connect to AWS-hosted MCP servers by automatically handling AWS IAM (SigV4) authentication.

  • Project
    joshuayoes/ios-simulator-mcp

    An MCP server that enables AI agents to control iOS simulators, perform UI interactions, and automate QA testing through programmatic tool calls.

  • Project
    appium/appium-mcp

    An MCP server that enables AI assistants to automate mobile app testing on iOS and Android using natural language and vision-based element finding.