policyuniverse

What it is and what it does

PolicyUniverse is a Python library for parsing, analyzing, and transforming AWS IAM and Resource Policies. It provides classes to extract and inspect policy components—principals, actions, resources, and conditions—and includes utilities to detect whether a policy is internet-accessible, expand wildcard actions to their full permission sets, and minify policies to reduce their size. The package ships with a built-in permissions dataset from the AWS Policy Generator.

It is primarily used by security teams and infrastructure auditors to understand and validate IAM policies programmatically. Common tasks include checking whether a policy grants unintended public access, categorizing actions by type (Read, Write, Permissions, etc.), and expanding wildcards like `s3:*` into their constituent permissions for detailed analysis. The library has no external runtime dependencies, making it lightweight to integrate into automation and compliance tools.

Use it for:

• Audit IAM policies for internet accessibility and overly permissive principal grants in automated security scanning.
• Expand wildcard actions in policies to enumerate exactly which permissions are granted for compliance reporting.
• Parse and categorize policy actions by type (Read, Write, Permissions, Tagging, List) to summarize policy impact.
• Extract principals, accounts, VPCs, and IP ranges from policy conditions for access control analysis.
• Minify large policies to stay within AWS policy size limits when consolidating multiple statements.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parses and analyzes AWS IAM and Resource Policies, extracts principals and conditions, detects internet accessibility, and expands or minifies policy wildcards.

Yes, if you need to parse and analyze AWS IAM policies programmatically. The package is lightweight, has no dependencies, and covers the core use cases of policy inspection and wildcard expansion well. However, note the dormant maintenance status—last release was 988 days ago—so verify compatibility with your AWS policy version and consider whether you need active support before adopting it for critical compliance workflows.

Install

policyuniverse on PyPI

pip install policyuniverse

uv add policyuniverse

poetry add policyuniverse

Installing policyuniverse

Before you install

Low install friction with no runtime dependencies. Dormant maintenance status—last release was 988 days ago and last commit in June 2024—but the repository remains active with 448 stars and no known vulnerabilities.

License in practice

Licensed under Apache License 2.0 (permissive), allowing commercial and private use with minimal restrictions.

Quickstart

from policyuniverse.arn import ARN
from policyuniverse.policy import Policy

arn = ARN('arn:aws:iam::012345678910:role/TestRole')
policy = Policy({'Version': '2012-10-08', 'Statement': [{'Effect': 'Allow', 'Principal': '*', 'Action': 's3:*', 'Resource': '*'}]})
print(policy.is_internet_accessible())

Verify before relying

• Whether the dormant status (988 days since last release) affects compatibility with recent AWS IAM policy changes or new permissions.
• Performance characteristics when processing large or complex policies with many statements and conditions.

Package facts

Evidence: policyuniverse-1.5.1.20231109-py2.py3-none-any.whl

Keywords: iam, arn, action_groups, condition, policy, statement, wildcard

Tags

More Security packages