Aws/iam
Cross-account IAM observation model for role, user, and policy inventory. Factory-pattern discovery fans out across AWS profiles to capture trust policies, access key metadata, permission boundaries, and builds a cross-account trust graph for security analysis.
Produces typed, versioned state queryable via CEL for privilege escalation path analysis, unused permission detection, and external trust mapping.
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: read roles for only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
Resources
2026.07.21.1
Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).
Upgrade note: No behavioral changes. Routine dependency maintenance.
2026.07.18.2
Added: An upgrades array entry (no-op) to iam.ts for proper
typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and
@aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency
freshness. No behavior change.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
2026.07.18.1
Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and
@aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency
freshness. No behavior change.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned