py-iam-expand
This is a Python package to expand and deobfuscate IAM policies.
Decision gist · record as of 2026-08-14
Yes. The package solves a real problem in AWS security analysis with low install friction, active maintenance, permissive licensing, and no known vulnerabilities. It's most valuable if you regularly audit IAM policies or need to understand what permissions wildcards actually grant; less critical if you only work with fully enumerated actions.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python >3.9.1 and <3.15; depends on iamdata package for AWS IAM action definitions.
- Low friction install with a single runtime dependency (iamdata).
- Active maintenance with a recent release (2026-02-24) and ongoing commits; last commit 2026-06-19.
License · maintenance · safety
Apache-2.0 (permissive) — Apache-2.0 permissive license allows use in commercial and open-source projects with minimal restrictions; you must include a copy of the license and state material changes.
last release 2026-02-24 (171 days) · last repo commit 2026-06-19 · 9 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 118,609 downloads/mo, #12,112 on PyPI
Alternatives
Verify before relying
pip install py-iam-expand
from py_iam_expand import expand_actions
expanded = expand_actions(['s3:Get*'])
print(expanded)- Whether the iamdata dependency is kept current with AWS IAM service updates and how often it refreshes
- Performance characteristics when expanding large policy documents or complex wildcard patterns
- Whether the CLI handles all valid IAM action formats and edge cases in real-world policies
What it is and what it does
py-iam-expand is a command-line and library tool for analyzing AWS IAM policies by expanding wildcard patterns in action statements. It resolves patterns like `s3:Get*` or `ec2:Describe*` into their full list of concrete IAM actions, and can invert patterns to find actions that do not match specified criteria. The tool also removes obfuscation characters from policies and handles invalid actions according to your preference (raise error, remove silently, or keep them).
The package wraps the iamdata library to access authoritative AWS IAM action definitions. It works both as a CLI tool (reading action patterns or JSON policy documents from arguments or stdin) and as a Python library for programmatic use. It's designed to help security teams and developers understand what permissions a policy actually grants when wildcards or obfuscation are involved.
Use it for
- Audit IAM policies to see the full set of S3, EC2, or other service actions granted by wildcard patterns.
- Invert action patterns to identify which actions are explicitly excluded by a NotAction statement.
- Process JSON IAM policy documents to expand all wildcards and produce a fully resolved policy for compliance review.
- Detect obfuscated or malformed IAM actions in policies and decide whether to flag, remove, or keep them.
- Integrate policy analysis into CI/CD pipelines to validate that IAM policies grant only intended permissions.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package solves a real problem in AWS security analysis with low install friction, active maintenance, permissive licensing, and no known vulnerabilities. It's most valuable if you regularly audit IAM policies or need to understand what permissions wildcards actually grant; less critical if you only work with fully enumerated actions.
Install
py-iam-expand on PyPI
Before you install
Low friction install with a single runtime dependency (iamdata). Active maintenance with a recent release (2026-02-24) and ongoing commits; last commit 2026-06-19.
Requires Python >3.9.1 and <3.15; depends on iamdata package for AWS IAM action definitions.
License in practice
Apache-2.0 permissive license allows use in commercial and open-source projects with minimal restrictions; you must include a copy of the license and state material changes.
Quickstart
pip install py-iam-expand
from py_iam_expand import expand_actions
expanded = expand_actions(['s3:Get*'])
print(expanded)Verify before relying
- Whether the iamdata dependency is kept current with AWS IAM service updates and how often it refreshes
- Performance characteristics when expanding large policy documents or complex wildcard patterns
- Whether the CLI handles all valid IAM action formats and edge cases in real-world policies
Package facts
| License | Apache-2.0 permissive |
| Python support | Supports the current Python release <3.15,>3.9.1 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packageiamdata |
| Maintenance | Actively maintained 171 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 118,609 / month, #12,112 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | License :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3 |
Evidence: py_iam_expand-0.3.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “aws iam action expansion”
- py-iam-expandExpands and deobfuscates AWS IAM action patterns, resolving wildcards…
- iamdataProvides programmatic access to AWS IAM service definitions—actions,…
- policyuniverseParses and analyzes AWS IAM and Resource Policies, extracts…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also policyuniverse · cloudsplaining · iamdata · policy-sentry · aws-cdk.aws-iam · awacs · drf-access-policy · uri-template · cloudsec-audit · parameter-expansion-patched