IAM Policy Analyzer

Analyze IAM policies, detect permission violations, and automatically generate least-privilege policies based on actual usage.

Capabilities

• Enforce IAM policies locally
• Detect permission violations
• Auto-generate policies from access patterns
• Analyze existing policies for issues
• Test policies before deploying to AWS

Prerequisites

• The lstk CLI, authenticated with a LocalStack account (lstk login, or LOCALSTACK_AUTH_TOKEN in CI) — see the localstack skill
• Optional: the legacy localstack CLI (pip install localstack) for the IAM policy stream — see Auto-Generate Policies. lstk has no equivalent command yet.

IAM Enforcement Modes