---
id: py-iam-expand
version: "0.3.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# py-iam-expand — This is a Python package to expand and deobfuscate IAM policies.

License: permissive · Maintenance: active · Downloads: 118.6K/mo

## What it is and what it does

py-iam-expand is a command-line and library tool for analyzing AWS IAM policies by expanding wildcard patterns in action statements. It resolves patterns like `s3:Get*` or `ec2:Describe*` into their full list of concrete IAM actions, and can invert patterns to find actions that do not match specified criteria. The tool also removes obfuscation characters from policies and handles invalid actions according to your preference (raise error, remove silently, or keep them).

The package wraps the iamdata library to access authoritative AWS IAM action definitions. It works both as a CLI tool (reading action patterns or JSON policy documents from arguments or stdin) and as a Python library for programmatic use. It's designed to help security teams and developers understand what permissions a policy actually grants when wildcards or obfuscation are involved.

Use it for:

- Audit IAM policies to see the full set of S3, EC2, or other service actions granted by wildcard patterns.
- Invert action patterns to identify which actions are explicitly excluded by a NotAction statement.
- Process JSON IAM policy documents to expand all wildcards and produce a fully resolved policy for compliance review.
- Detect obfuscated or malformed IAM actions in policies and decide whether to flag, remove, or keep them.
- Integrate policy analysis into CI/CD pipelines to validate that IAM policies grant only intended permissions.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Expands and deobfuscates AWS IAM action patterns, resolving wildcards and inverting action sets to reveal the concrete permissions they represent.

Yes. The package solves a real problem in AWS security analysis with low install friction, active maintenance, permissive licensing, and no known vulnerabilities. It's most valuable if you regularly audit IAM policies or need to understand what permissions wildcards actually grant; less critical if you only work with fully enumerated actions.

## Install

pip install py-iam-expand
uv add py-iam-expand
poetry add py-iam-expand

## Installing py-iam-expand

Before you install: Low friction install with a single runtime dependency (iamdata). Active maintenance with a recent release (2026-02-24) and ongoing commits; last commit 2026-06-19.

License in practice: Apache-2.0 permissive license allows use in commercial and open-source projects with minimal restrictions; you must include a copy of the license and state material changes.

Quickstart:

pip install py-iam-expand

from py_iam_expand import expand_actions

expanded = expand_actions(['s3:Get*'])
print(expanded)

Requires Python >3.9.1 and <3.15; depends on iamdata package for AWS IAM action definitions.

Verify before relying:

- Whether the iamdata dependency is kept current with AWS IAM service updates and how often it refreshes
- Performance characteristics when expanding large policy documents or complex wildcard patterns
- Whether the CLI handles all valid IAM action formats and edge cases in real-world policies

## Package facts

- License: Apache-2.0 (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 118.6K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

aws iam action expansion, iam policy wildcard resolution, deobfuscate iam permissions, expand iam action patterns, iam policy analysis tool, aws permission pattern matching, iam action inversion, aws-iam, policy-analysis, security-audit

[View on SkillFed](https://skillfed.io/packages/py-iam-expand) · [View on PyPI](https://pypi.org/project/py-iam-expand/)