cloudsplaining

What it is and what it does

Cloudsplaining is an AWS IAM security assessment tool that identifies overly permissive IAM policies—specifically actions that lack resource constraints. It flags risky permission patterns including data exfiltration (s3:GetObject, ssm:GetParameter, secretsmanager:GetSecretValue), infrastructure modification, resource exposure, privilege escalation, and credentials exposure. The tool generates an HTML report that prioritizes findings by risk level, making it easy to identify which policies need remediation first.

You can scan a single policy file, all policies in one AWS account, or across multiple accounts. It also identifies IAM roles assumable by AWS compute services (EC2, ECS, EKS, Lambda) that may pose elevated risk if those services are internet-exposed. The tool supports custom exclusion files to filter false positives based on your organization's architecture and multi-account strategy.

Use it for:

• Audit existing IAM policies in production AWS accounts to find permissions that violate least privilege before they cause a breach.
• Scan a policy file during infrastructure-as-code review to catch overly permissive statements before deployment.
• Identify EC2 or Lambda roles that could be exploited if the compute service is compromised or exposed to the internet.
• Generate a prioritized remediation backlog across dozens of AWS accounts by flagging the highest-risk policies first.
• Detect data exfiltration vectors (unrestricted s3:GetObject, secretsmanager:GetSecretValue) in your account's role definitions.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Cloudsplaining scans AWS IAM policies to identify violations of least privilege and generates a risk-prioritized HTML report highlighting dangerous permissions without resource constraints.

Yes. Cloudsplaining is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and solves a concrete security problem—finding least-privilege violations in IAM policies. If you manage AWS accounts and need to audit or improve IAM security posture, this tool directly addresses that need with low install friction and clear, actionable output.

Install

cloudsplaining on PyPI

pip install cloudsplaining

uv add cloudsplaining

poetry add cloudsplaining

Installing cloudsplaining

Before you install

Low friction: pure Python wheel with 8 runtime dependencies (boto3, botocore, click, jinja2, policy-sentry, pyyaml, schema, click-option-group). Actively maintained—last commit 2026-08-11, 2243 GitHub stars, no known vulnerabilities.

License in practice

MIT license (permissive) allows unrestricted use, modification, and distribution in both open and closed-source projects.

Quickstart

pip install cloudsplaining
cloudsplaining scan-policy-file --input-file policy.json

Requires Python >=3.10. For account-wide scanning, AWS credentials must be configured (boto3/botocore will use standard AWS credential chain).

Verify before relying

• Whether the tool can scan multiple AWS accounts in a single run or requires separate invocations per account.
• Performance characteristics when scanning large numbers of policies or accounts.

Package facts

Evidence: cloudsplaining-0.9.1-py3-none-any.whl

Keywords: aws, iam, roles, policy, policies, privileges, security

Tags

More Security packages