--- id: cloudsplaining version: "0.9.1" license: MIT license_treatment: permissive maintenance: active --- # cloudsplaining — AWS IAM Security Assessment tool that identifies violations of least privilege and generates a risk-prioritized HTML report License: permissive · Maintenance: active · Downloads: 4.6M/mo ## What it is and what it does Cloudsplaining is an AWS IAM security assessment tool that identifies overly permissive IAM policies—specifically actions that lack resource constraints. It flags risky permission patterns including data exfiltration (s3:GetObject, ssm:GetParameter, secretsmanager:GetSecretValue), infrastructure modification, resource exposure, privilege escalation, and credentials exposure. The tool generates an HTML report that prioritizes findings by risk level, making it easy to identify which policies need remediation first. You can scan a single policy file, all policies in one AWS account, or across multiple accounts. It also identifies IAM roles assumable by AWS compute services (EC2, ECS, EKS, Lambda) that may pose elevated risk if those services are internet-exposed. The tool supports custom exclusion files to filter false positives based on your organization's architecture and multi-account strategy. Use it for: - Audit existing IAM policies in production AWS accounts to find permissions that violate least privilege before they cause a breach. - Scan a policy file during infrastructure-as-code review to catch overly permissive statements before deployment. - Identify EC2 or Lambda roles that could be exploited if the compute service is compromised or exposed to the internet. - Generate a prioritized remediation backlog across dozens of AWS accounts by flagging the highest-risk policies first. - Detect data exfiltration vectors (unrestricted s3:GetObject, secretsmanager:GetSecretValue) in your account's role definitions. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Cloudsplaining scans AWS IAM policies to identify violations of least privilege and generates a risk-prioritized HTML report highlighting dangerous permissions without resource constraints. Yes. Cloudsplaining is actively maintained, has no known vulnerabilities, uses a permissive MIT license, and solves a concrete security problem—finding least-privilege violations in IAM policies. If you manage AWS accounts and need to audit or improve IAM security posture, this tool directly addresses that need with low install friction and clear, actionable output. ## Install pip install cloudsplaining uv add cloudsplaining poetry add cloudsplaining ## Installing cloudsplaining Before you install: Low friction: pure Python wheel with 8 runtime dependencies (boto3, botocore, click, jinja2, policy-sentry, pyyaml, schema, click-option-group). Actively maintained—last commit 2026-08-11, 2243 GitHub stars, no known vulnerabilities. License in practice: MIT license (permissive) allows unrestricted use, modification, and distribution in both open and closed-source projects. Quickstart: pip install cloudsplaining cloudsplaining scan-policy-file --input-file policy.json Requires Python >=3.10. For account-wide scanning, AWS credentials must be configured (boto3/botocore will use standard AWS credential chain). Verify before relying: - Whether the tool can scan multiple AWS accounts in a single run or requires separate invocations per account. - Performance characteristics when scanning large numbers of policies or accounts. ## Package facts - License: MIT (permissive) - Python support: supports_current - Install friction: low - Maintenance: active - Downloads: 4.6M/month (top 5,000 on PyPI) - Known vulnerabilities: none known ## Tags AWS IAM policy security audit, least privilege violation detection, IAM privilege escalation risk, AWS security assessment tool, IAM policy analysis report, data exfiltration risk finder, AWS account permission audit, aws-security, iam-audit, policy-analysis [View on SkillFed](https://skillfed.io/packages/cloudsplaining) · [View on PyPI](https://pypi.org/project/cloudsplaining/)