policyuniverse
Parse and Process AWS IAM Policies, Statements, ARNs, and wildcards.
Decision gist · record as of 2026-08-14
Yes, if you need to parse and analyze AWS IAM policies programmatically. The package is lightweight, has no dependencies, and covers the core use cases of policy inspection and wildcard expansion well. However, note the dormant maintenance status—last release was 988 days ago—so verify compatibility with your AWS policy version and consider whether you need active support before adopting it for critical compliance workflows.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low install friction with no runtime dependencies.
- Dormant maintenance status—last release was 988 days ago and last commit in June 2024—but the repository remains active with 448 stars and no known vulnerabilities.
License · maintenance · safety
permissive license (permissive) — Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions.
last release 2023-11-30 (988 days) · last repo commit 2024-06-21 · 448 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 519,870 downloads/mo, #6,214 on PyPI
Alternatives
Verify before relying
from policyuniverse.arn import ARN
from policyuniverse.policy import Policy
arn = ARN('arn:aws:iam::012345678910:role/TestRole')
policy = Policy({'Version': '2012-10-08', 'Statement': [{'Effect': 'Allow', 'Principal': '*', 'Action': 's3:*', 'Resource': '*'}]})
print(policy.is_internet_accessible())- Whether the dormant status (988 days since last release) affects compatibility with recent AWS IAM policy changes or new permissions.
- Performance characteristics when processing large or complex policies with many statements and conditions.
What it is and what it does
PolicyUniverse is a Python library for parsing, analyzing, and transforming AWS IAM and Resource Policies. It provides classes to extract and inspect policy components—principals, actions, resources, and conditions—and includes utilities to detect whether a policy is internet-accessible, expand wildcard actions to their full permission sets, and minify policies to reduce their size. The package ships with a built-in permissions dataset from the AWS Policy Generator.
It is primarily used by security teams and infrastructure auditors to understand and validate IAM policies programmatically. Common tasks include checking whether a policy grants unintended public access, categorizing actions by type (Read, Write, Permissions, etc.), and expanding wildcards like `s3:*` into their constituent permissions for detailed analysis. The library has no external runtime dependencies, making it lightweight to integrate into automation and compliance tools.
Use it for
- Audit IAM policies for internet accessibility and overly permissive principal grants in automated security scanning.
- Expand wildcard actions in policies to enumerate exactly which permissions are granted for compliance reporting.
- Parse and categorize policy actions by type (Read, Write, Permissions, Tagging, List) to summarize policy impact.
- Extract principals, accounts, VPCs, and IP ranges from policy conditions for access control analysis.
- Minify large policies to stay within AWS policy size limits when consolidating multiple statements.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to parse and analyze AWS IAM policies programmatically.
The package is lightweight, has no dependencies, and covers the core use cases of policy inspection and wildcard expansion well. However, note the dormant maintenance status—last release was 988 days ago—so verify compatibility with your AWS policy version and consider whether you need active support before adopting it for critical compliance workflows.
Install
policyuniverse on PyPI
Before you install
Low install friction with no runtime dependencies. Dormant maintenance status—last release was 988 days ago and last commit in June 2024—but the repository remains active with 448 stars and no known vulnerabilities.
License in practice
Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions.
Quickstart
from policyuniverse.arn import ARN
from policyuniverse.policy import Policy
arn = ARN('arn:aws:iam::012345678910:role/TestRole')
policy = Policy({'Version': '2012-10-08', 'Statement': [{'Effect': 'Allow', 'Principal': '*', 'Action': 's3:*', 'Resource': '*'}]})
print(policy.is_internet_accessible())Verify before relying
- Whether the dormant status (988 days since last release) affects compatibility with recent AWS IAM policy changes or new permissions.
- Performance characteristics when processing large or complex policies with many statements and conditions.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.7 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Dormant 988 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 519,870 / month, #6,214 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: Apache Software License |
Evidence: policyuniverse-1.5.1.20231109-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “AWS IAM policy parser”
- policyuniverseParses and analyzes AWS IAM and Resource Policies, extracts…
- policy-sentryPolicy Sentry generates least-privilege AWS IAM policies from…
- awacsawacs generates AWS IAM policy JSON from Python code, with built-in…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also iamdata · policy-sentry · py-iam-expand · awacs · arn · aws-cdk.aws-iam · arnparse · cloudsplaining · drf-access-policy · cdk-iam-floyd