policy-sentry

What it is and what it does

Policy Sentry is a command-line tool and Python library that generates AWS IAM policies by mapping resource ARNs and access levels (Read, Write, List, Tagging, Permissions Management) to the specific IAM actions that support them. Instead of manually reviewing AWS documentation and writing policy JSON, you describe what resources you need access to and at what level, and the tool outputs a complete, least-privilege policy statement. It maintains an internal database of AWS actions, their access levels, and supported resource types, then queries that database to produce policies scoped to exactly what you specify.

The tool is designed for infrastructure-as-code developers and security teams who want to enforce least-privilege principles without the tedium of hand-crafting policies. It supports both CLI workflows (create templates, fill in ARNs, generate policies) and Python library usage for programmatic policy generation. The package depends on click for CLI handling, beautifulsoup4 and requests for fetching AWS documentation, orjson for fast JSON serialization, pyyaml for template parsing, and schema for validation.

Use it for:

• Generate least-privilege IAM policies for Lambda functions, EC2 roles, or service accounts by specifying only the resources and access levels needed.
• Automate policy creation in CI/CD pipelines to enforce security standards without manual policy review bottlenecks.
• Create CRUD-based policy templates for teams unfamiliar with AWS IAM action names and resource constraints.
• Reduce policy blast radius in breach scenarios by ensuring roles have only the minimum permissions required.
• Validate or regenerate existing IAM policies to ensure they follow least-privilege principles.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Policy Sentry generates least-privilege AWS IAM policies from resource ARNs and access levels, automating the creation of security-scoped policies that would otherwise require manual AWS documentation review.

Yes. Policy Sentry is actively maintained, has no known vulnerabilities, low install friction, and solves a real security problem—automating least-privilege IAM policy generation. It's appropriate for teams that want to enforce security best practices without manual AWS documentation review. The MIT license and broad Python version support (3.10–3.14) make it suitable for most environments.

Install

policy-sentry on PyPI

pip install policy-sentry

uv add policy-sentry

poetry add policy-sentry

Installing policy-sentry

Before you install

Low install friction with a pure Python wheel and six common dependencies. The package is actively maintained with recent releases, supports current Python versions (3.10–3.14), and has been in development since 2019 with steady community engagement.

License in practice

MIT license permits unrestricted use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install policy_sentry

# Create a CRUD template
policy_sentry create-template --output-file crud.yml --template-type crud

# Edit crud.yml with your ARNs, then generate policy
policy_sentry write-policy --input-file crud.yml

Requires Python 3.10 or later; AWS IAM knowledge helpful but the tool abstracts most complexity.

Verify before relying

• Whether the embedded AWS IAM action database is kept current with new AWS services and actions.
• Performance characteristics when processing large numbers of ARNs or complex access-level combinations.
• Integration points with existing IaC workflows (Terraform, CloudFormation) beyond what the description mentions.

Package facts

Evidence: policy_sentry-0.15.2-py3-none-any.whl

Keywords: aws, iam, policies, policy, privileges, roles, security

Tags

More Security packages