AWS re:Invent 2025 - Automating IAM policy validation and analysis using GitHub Actions (SEC341)

Automating IAM Policy Validation and Analysis using GitHub Actions

Traditional IAM Management Models

• Centralized model: Security team creates standard IAM policies, developers must use what is provided
  • Challenges: Security team lacks application context, policies are often too broad or too narrow
  • Bottleneck as security team has to continuously update policies based on developer feedback
• Gated model: Developers create policies, security team reviews and approves
  • Challenges: Back-and-forth between developers and security, rework required if policies have issues

Delegated IAM Policy Management

• Security team builds automation to validate developer-authored IAM policies
• Policies automatically checked against organizational standards and best practices
• Developers get immediate feedback on policy issues, reducing back-and-forth
• Security team can focus on complex cases, not manual policy reviews

GitHub Actions for IAM Policy Validation

• GitHub Actions is a CI/CD automation platform for running code on GitHub events
• Allows automating IAM policy validation as part of the development workflow

AWS Access Analyzer

• Automated reasoning tool to analyze IAM and resource policies
• Provides APIs to validate policy syntax, check for new access, and detect public access
• Custom policy checks allow defining organizational standards and best practices

Automating IAM Policy Validation Workflow

1. Set up GitHub-to-AWS authentication using OIDC
2. Create an IAM role with permissions to Access Analyzer and other needed services
3. Store AWS configuration secrets in GitHub repository
4. Define reference IAM policies representing organizational standards
5. Store reference policies in an S3 bucket
6. Create a GitHub Actions workflow to:
   • Extract IAM resources from developer-submitted CloudFormation templates
   • Use Access Analyzer to validate policies against reference policies
   • If policy violations are found, generate prescriptive guidance using Bedrock AI
   • Create a GitHub issue with the guidance for the developer

Key Benefits

• Enables developer agility by allowing them to author IAM policies
• Enforces security team's guardrails through automated validation
• Provides prescriptive guidance to developers on how to fix policy issues
• Reduces back-and-forth between developers and security team
• Allows security team to focus on complex cases, not manual reviews

Real-World Applications

• Enforcing IAM policy standards across multiple business unit accounts
• Preventing developers from introducing overly permissive IAM policies
• Automating IAM policy validation as part of CI/CD pipelines
• Leveraging AI-generated guidance to help developers remediate issues

Resources

• AWS IAM Policy Samples Repository
• Blog Post on Automating IAM Policy Validation
• Workshop Content on Automating IAM Policy Validation