iann0036/iam-dataset

What it solves

Cloud platforms each have their own way of defining permissions and roles, which makes it hard to build tools that work across AWS, Azure, and Google Cloud. This project gathers those scattered definitions into a single, machine-readable collection so developers of security and access tools don't have to scrape or parse each provider separately.

How it works

The repository contains JSON files organized by cloud provider. For AWS, it includes a mapping from SDK calls to IAM actions (map.json), a full scrape of the official AWS Service Authorization Reference (iam_definition.json), and details on all AWS managed policies. For Azure, it provides raw role and operation lists pulled from Azure CLI commands, plus an aggregated file that combines built-in roles with their permitted operations. For Google Cloud, it includes predefined roles, IAM permissions, a permission-to-role mapping, and method definitions extracted from the Google Cloud Go SDK. A util/ directory holds tooling that helps regenerate some of these data sources.

Who it's for

Developers and projects that need reliable, up-to-date cloud IAM data — such as policy generators, permission checkers, access analyzers, or cloud security tools. The README lists several known consumers including iamlive, iamfast, aws.permissions.cloud, azure.permissions.cloud, gcp.permissions.cloud, claws, LocalStack, Access Undenied, and Otterize.

Highlights

• Consolidates IAM data for AWS, Azure, and Google Cloud in one place.
• AWS map.json maps SDK calls to IAM actions; iam_definition.json is scraped from the official AWS reference.
• Azure built-in-roles.json aggregates role definitions and provider operations.
• Google Cloud includes a permission-to-role mapping with undocumented-containment flags.
• Utility scripts help regenerate some data sources.