IAM Policy Autopilot

An open source Model Context Protocol (MCP) server and command-line tool that helps your AI coding assistants quickly create baseline IAM policies that you can refine as your application evolves, so you can build faster. IAM Policy Autopilot analyzes your application code locally to generate identity-based policies for application roles, enabling faster IAM policy creation and reducing access troubleshooting time. IAM Policy Autopilot supports policy generation for applications built in Python, Go, TypeScript, JavaScript, and Java, and can also generate policies from a Terraform plan file in JSON format — see Supported Languages and SDKs for policy generation.

We want to hear from you. Ask questions or share ideas in Discussions, report bugs through Issues, or contribute directly with a Pull Request.

Table of Contents

• Who is IAM Policy Autopilot for?
• How is IAM Policy Autopilot helpful?
• Best Practices and Considerations
• Getting Started
• Network Requirements
• CLI Usage
• Supported Languages and SDKs for policy generation
• Build Instructions
• Workspace Structure
• Development
• Security
• License

Who is IAM Policy Autopilot for?

IAM Policy Autopilot is for builders on AWS using AI coding assistants, including developers, product managers, technical experimenters, and business leaders.

How is IAM Policy Autopilot helpful?

IAM Policy Autopilot is:

Fast

IAM Policy Autopilot accelerates development by generating baseline identity-based IAM policies. Your AI coding assistant can call IAM Policy Autopilot to analyze AWS SDK calls within your application. IAM Policy Autopilot then automatically creates the baseline IAM permissions for your application roles.

Reliable

IAM Policy Autopilot's deterministic code analysis helps create reliable and valid IAM policies that reduce policy troubleshooting. By using valid policies created with the MCP server, you reduce time spent on policy-related debugging and accelerate application deployment by avoiding permission-related delays.

Up-to-date

IAM Policy Autopilot stays up to date with the latest AWS services and features so that builders and coding assistants have access to the latest AWS IAM permissions knowledge. It helps keep your application role's permissions current with AWS's evolving capabilities.

Best Practices and Considerations

Review and refine policies generated by IAM Policy Autopilot

IAM Policy Autopilot generates baseline policies to provide a starting point that you can refine as your application matures. Review the generated policies to ensure they align with your security requirements before deploying them. Use the --explain feature with action patterns (e.g., --explain 's3:*') to understand which operations led to an action being included in the generated policies.

Understand the IAM Policy Autopilot scope