Frequently Asked Questions
Common questions about how aws-iam.io works, its accuracy, and how to use the policies it generates.
What is a least-privilege IAM policy?
A least-privilege IAM policy grants only the specific AWS actions and resources a piece of code or role actually needs, instead of broad access like AmazonS3FullAccess or a wildcard *:* policy. It limits the damage a leaked credential or compromised process can do.
How does aws-iam.io generate a policy from my code?
It scans the boto3 client and resource calls in the Python code you paste, identifies which AWS service each variable is bound to (e.g. boto3.client('s3')), and looks up the real IAM action for each method call in a static dataset built from AWS's own Service Authorization Reference. If a method isn't in that dataset yet, it falls back to converting the snake_case method name to PascalCase and prefixing it with the service (e.g. put_object becomes s3:PutObject). No AWS API calls are made and your code is not executed.
Is my code sent or stored anywhere?
Your code is sent to our backend to be analyzed and is not executed. See our Privacy Policy for full details on what is logged and for how long.
Which AWS services and boto3 methods are supported?
Any boto3 client or resource method can be picked up. Common methods are matched against an authoritative AWS action dataset; anything not yet in that dataset falls back to a general naming rule. See the boto3-to-IAM action reference for a table of common services and naming quirks.
Why might the generated policy be slightly wrong?
Most IAM actions come from an authoritative AWS dataset, so common naming quirks (like the Lambda invoke() method mapping to lambda:InvokeFunction, not lambda:Invoke) are already handled correctly. The main remaining gap is boto3's resource-style method calls, such as an S3 Object's .delete(), where the method name alone doesn't say which resource type it acts on. These cases are documented on the boto3-to-IAM action reference page — always review the generated policy before attaching it to a role.
Is aws-iam.io free?
Yes, the generator is free to use.
Do you support languages other than Python?
Not yet. Python (boto3) is currently the only supported SDK. Sign up on the homepage to be notified when new languages are added.
How do I use the generated JSON policy in AWS?
Copy the generated JSON and attach it as an inline or managed policy on an IAM role or user, either through the AWS Console (IAM > Policies > Create policy > JSON tab) or via infrastructure-as-code tools like Terraform or CloudFormation.