Introduction

IAM policies can grant broader access than an application needs. A statement such as "Action": "*" combined with "Resource": "*" is a clear warning sign, while broad service permissions and sensitive IAM actions can also introduce unnecessary privilege.

This project compares an intentionally over-permissive IAM identity policy with a scoped S3 example. It uses three complementary review stages:

A local Python JSON checker that detects a deliberately limited set of risky patterns.

AWS IAM Access Analyzer policy validation.

AWS IAM Policy Simulator evaluations for selected action/resource pairs.

The workflow is review-only. It does not create IAM identities, attach policies, create an S3 bucket, or provision compute or storage infrastructure. The AWS API calls validate and simulate policy documents; they do not execute S3 operations.

Implementation Status: Implementation completed successfully.…