{"uid":"cap_PYGB-mUZ9KqeEIjlncaZ5","slug":"aws-iam-identity-policy-risk-reviewer-90a2a984","name":"AWS IAM Identity Policy Risk Reviewer","description":"Analyzes AWS IAM policies to detect risky permissions and security misconfigurations.","url":"https://47-85-47-24.sslip.io/v1/aws-iam-policy-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["administrator-and-passrole"],"type":"string","description":"Built-in paid AWS IAM policy risk-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","policy_type","profile","verdict","risk_score","summary","stats","statements","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"profile":{"enum":["production","development"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"statements":{"type":"array","items":{"type":"object"}},"analysis_id":{"type":"string"},"policy_type":{"enum":["identity","resource","trust","permissions-boundary","scp"],"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:administrator-and-passrole","stats":{"policy_bytes":253,"string_count":21,"statement_count":2,"tree_node_count":16,"deny_statement_count":0,"findings_by_severity":{"low":0,"high":4,"medium":5,"critical":3},"action_selector_count":4,"allow_statement_count":2,"resource_selector_count":2,"broad_allow_statement_count":2},"profile":"production","summary":"BLOCK: 12 finding(s) across 2 statement(s); 7 require resolution or explicit approval.","verdict":"BLOCK","coverage":{"mode":"static-aws-iam-json-policy","checks":["IAM policy grammar and element combinations","least-privilege action and resource scope","public, service, cross-account, and federated principals","sensitive condition wildcarding","PassRole and workload-creation escalation chains","credential, secret, key, and organization permissions","MFA and transport guardrails"],"limitations":["Does not evaluate identity, resource, boundary, session, SCP, and RCP policies together.","Does not know which principals, resources, tags, organization paths, or identity-provider claims exist in the target account.","Does not replace IAM Access Analyzer validation, custom policy checks, policy simulation, or CloudTrail-based least-privilege refinement."],"policy_simulated":false,"aws_api_contacted":false,"credentials_loaded":false,"condition_values_returned":false},"findings":[{"code":"allow_all_actions","path":"Statement[0].Action","message":"The statement grants every AWS action.","severity":"critical","standard":"aws-iam-least-privilege","remediation":"Replace * with the smallest task-specific action allowlist."},{"code":"passrole_deployment_escalation_chain","path":"Statement[0].Action","message":"The statement combines PassRole with a workload-creation action that can execute as another role.","severity":"critical","standard":"aws-iam-privilege-escalation","remediation":"Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions."},{"code":"passrole_deployment_escalation_chain","path":"Statement[1].Action","message":"The statement combines PassRole with a workload-creation action that can execute as another role.","severity":"critical","standard":"aws-iam-privilege-escalation","remediation":"Separate deployment and role-delegation permissions, constrain both resources, and enforce service and tag conditions."},{"code":"passrole_all_resources","path":"Statement[0].Resource","message":"iam:PassRole can target every role.","severity":"high","standard":"aws-iam-passrole","remediation":"Restrict Resource to approved execution roles and add iam:PassedToService."},{"code":"wildcard_resource","path":"Statement[0].Resource","message":"The allow statement applies to every resource.","severity":"high","standard":"aws-iam-least-privilege","remediation":"Scope Resource to exact ARNs and use conditions only as a secondary boundary."},{"code":"passrole_all_resources","path":"Statement[1].Resource","message":"iam:PassRole can target every role.","severity":"high","standard":"aws-iam-passrole","remediation":"Restrict Resource to approved execution roles and add iam:PassedToService."},{"code":"wildcard_resource","path":"Statement[1].Resource","message":"The allow statement applies to every resource.","severity":"high","standard":"aws-iam-least-privilege","remediation":"Scope Resource to exact ARNs and use conditions only as a secondary boundary."},{"code":"partial_action_wildcard","path":"Statement[0].Action","message":"The statement uses wildcard action patterns whose future match set can expand.","severity":"medium","standard":"aws-iam-least-privilege","remediation":"Prefer explicit action names or tightly review the wildcard pattern and service evolution."},{"code":"passrole_missing_service_boundary","path":"Statement[0].Condition","message":"iam:PassRole is not constrained to an intended destination service.","severity":"medium","standard":"aws-iam-passrole","remediation":"Add an iam:PassedToService condition and an exact role ARN allowlist."},{"code":"privileged_action_without_mfa_condition","path":"Statement[0].Condition","message":"Production privilege-management actions have no policy-level MFA condition.","severity":"medium","standard":"aws-iam-mfa-best-practice","remediation":"Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."},{"code":"passrole_missing_service_boundary","path":"Statement[1].Condition","message":"iam:PassRole is not constrained to an intended destination service.","severity":"medium","standard":"aws-iam-passrole","remediation":"Add an iam:PassedToService condition and an exact role ARN allowlist."},{"code":"privileged_action_without_mfa_condition","path":"Statement[1].Condition","message":"Production privilege-management actions have no policy-level MFA condition.","severity":"medium","standard":"aws-iam-mfa-best-practice","remediation":"Require MFA for human-admin paths or ensure the policy is attached only to tightly controlled workload roles."}],"risk_score":100,"statements":[{"sid":"AdministratorAccess","index":0,"effect":"Allow","action_count":1,"service_names":[],"resource_count":1,"principal_count":0,"principal_types":[],"uses_not_action":false,"uses_not_resource":false,"condition_key_count":0},{"sid":"DeployAsAnyRole","index":1,"effect":"Allow","action_count":3,"service_names":["iam","lambda","secretsmanager"],"resource_count":1,"principal_count":0,"principal_types":[],"uses_not_action":false,"uses_not_resource":false,"condition_key_count":0}],"analysis_id":"iam-cc3bf126a64835168c71","policy_type":"identity","approval_gates":["Resolve or explicitly approve 7 critical/high policy finding(s) before attachment or deployment.","Prove the necessity and effective boundary of 2 broad allow statement(s) with IAM Access Analyzer or policy simulation in the target account.","Confirm that PassRole is restricted to approved role ARNs and destination services and cannot form a workload-creation escalation chain."],"analyzer_version":"iamguard-aws-policy/1.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_lL6BtQcjOEMRUFGHUOoVX","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a built-in risky AWS IAM identity policy for administrator access, wildcard resources, PassRole, workload-creation escalation, secret access, and least-privilege violations without requiring live AWS account access","exampleAgentPrompt":"Run a security risk review on the built-in administrator-and-passrole IAM identity policy scenario and tell me the verdict, risk score, and any critical findings I should care about.","exampleUseCases":null,"resultDescription":"Returns a structured analysis including a risk score (0-100), a verdict (BLOCK/WARN/PASS), a summary, per-statement findings with severity details, approval gates required before deployment, and coverage metrics — all derived from static analysis of the built-in risky IAM policy without touching a live AWS account.","failureModes":["Invalid or unsupported scenario enum value returns an error","Missing required query parameters may return a 400 bad request","Service unavailable or payment failure returns a 402 or 503","Unsupported HTTP method returns a 405"],"whenToPreferThis":"Choose this endpoint when you need a fast, offline static analysis of AWS IAM identity policy risks — especially for the administrator-and-passrole escalation pattern — without needing to connect to or authenticate against a real AWS account. Prefer it over live AWS Access Analyzer when you want deterministic, reproducible risk scoring with structured findings and approval gates for CI/CD gating.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T18:47:13.445Z","isFirstParty":false}