iam-policy-validator

name	iam-policy-validator
description	Validate, analyze, and query AWS IAM policies with the iam-policy-validator CLI, and export findings as JSON for a second agent to verify and post to a GitHub PR. Use when checking, validating, linting, or auditing IAM identity, resource, or trust policies, SCPs, or RCPs; when the user mentions wildcard actions, privilege escalation, sensitive actions, confused deputy, or overly permissive policies; when querying which AWS actions, condition keys, or ARNs a service supports (or which actions support a condition key); when running AWS IAM Access Analyzer; or when exporting SARIF/Markdown/HTML/JSON findings for PR review. CLI-based alternative to the MCP server.
argument-hint	[validate|query|analyze] <policy-path|dir> [--config <file>] [--export-json <file>]

IAM Policy Validator (CLI)

Validate AWS IAM policies against 22 built-in checks and query AWS service definitions. Self-contained: needs only the CLI (uvx, no install) plus Python 3.10+.

Home: https://github.com/boogy/iam-policy-validator · Docs: https://boogy.github.io/iam-policy-validator/

What do you need to do?

Goal	Command
Validate a policy file or directory	iam-validator validate --path <path>
Validate and post findings to a PR	validate --format json -> verify -> post-to-pr (see below)
Query AWS actions, ARNs, conditions	iam-validator query action|arn|condition --service <svc>