Aws/iam
Cross-account IAM observation model for role, user, and policy inventory. Factory-pattern discovery fans out across AWS profiles to capture trust policies, access key metadata, permission boundaries, and builds a cross-account trust graph for security analysis.
Produces typed, versioned state queryable via CEL for privilege escalation path analysis, unused permission detection, and external trust mapping.
2026.09.04.1
Changed: Bump @aws-sdk/* 3.1121.0 → 3.1126.0 (3 packages)
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: read roles for only these profiles (default: all configured profiles) |
| Argument | Type | Description |
|---|---|---|
| profiles? | array | Override: scan only these profiles (default: all configured profiles) |
Resources
2026.08.29.1
Changed: Bump @aws-sdk/* 3.1120.0 → 3.1121.0. Dependency-only update; no schema, API, or behavioral changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.2
Changed: Normalized the extension license to Apache-2.0 and corrected the copyright holder to "Sean Escriva". Extensions that previously shipped an MIT LICENSE.md are now Apache-2.0, consistent with the repository root and every other extension. No code or behavioral changes.
Upgrade note: License text only. No API, schema, or runtime behavior changed.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.28.1
Changed: Bump @aws-sdk/* 3.1114.0 → 3.1120.0 (3 packages)
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.26.2
Fixed: Restored inline npm:zod@4.4.3 import specifiers so the registry
quality scorer can resolve dependencies and score the extension. An earlier
release used a bare "zod" import-map specifier, which published but scored as
unscored.
Changed: Retained explicit compilerOptions.strict in deno.json. No
behavioral or schema changes.
2026.08.25.1
Changed: Updated labels for improved extension discoverability. Added cross-cutting category labels (security, observability, finops, infrastructure, networking, compliance, devops, ai, incident-response) where applicable.
updated labels
2026.08.24.1
Added: Output metadata attributes for observability.
durationMs: Method execution duration in milliseconds.collectedBy: Extension name that produced the data.fetchedAt: ISO 8601 timestamp when data was fetched (added to resources that previously lacked it).
2026.08.23.1
Fixed: README's five usage examples used a broken CLI command form
(method before instance, extension name spliced in). Corrected to the
standard swamp model method run <instance> <method> form used elsewhere.
Changed: Documentation only — no code changes otherwise. Clarified that
discover_trust_map reads previously written roles-<profile> resources and
never calls the IAM API itself. Added a ## Troubleshooting section covering
the per-profile silent degrade in discover_all, the exact error thrown by
discover_trust_map when no role data exists, pathPrefix filtering to an
empty result set with no error signal, the MAX_PAGES = 200 pagination cap,
and the silent catch on malformed AssumeRolePolicyDocument that drops a role
from the trust graph.
2026.08.21.1
Changed: Per-profile scan failures in discover_roles, discover_users,
and discover_policies are now logged at warn level instead of info —
they were previously indistinguishable from routine progress messages, so a
credential failure or throttled account could silently disappear from the
scan with no visible signal. The log message now also names the discovery
operation (discover_roles/discover_users/discover_policies) alongside
the profile, and uses the underlying error's message rather than its full
string representation.
No schema changes.
2026.08.20.1
Changed: Bump @aws-sdk/* 3.1111.0 → 3.1114.0 (3 packages)
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.08.15.1
Changed: Bump @aws-sdk/* 3.1104.0 → 3.1111.0 (3 packages)
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.08.05.1
Changed: Bump @aws-sdk/* 3.1101.0 → 3.1104.0 (3 packages)
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.08.02.1
Changed: Bump @aws-sdk/* 3.1100.0 → 3.1101.0 (3 packages)
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.08.01.1
Fixed: Broken model-upgrade chain. The prior version bump (to 2026.07.31.1) updated version but left the upgrades array terminating one step short, which blocks swamp extension push ("model upgrade chain errors"). That version never actually published — the registry was still serving 2026.07.29.1. This release closes the chain with a no-op upgrade entry and republishes everything that had accumulated since 2026.07.29.1.
2026.07.31.1
Changed: Bump @aws-sdk/* 3.1096.0 → 3.1100.0 (3 packages)
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.29.1
Fixed: Terminate upgrade chain at current version (extension was uninstallable due to broken upgrade chain).
2026.07.27.1
Changed: Bump @aws-sdk/* 3.1094.0 → 3.1096.0 (3 packages)
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.24.1
Changed: Bump AWS SDK from 3.1091.0 to 3.1094.0 (patch-level update).
2026.07.21.1
Changed: Bumped AWS SDK dependencies to 3.1091.0 (from 3.1090.0).
Upgrade note: No behavioral changes. Routine dependency maintenance.
2026.07.18.2
Added: An upgrades array entry (no-op) to iam.ts for proper
typeVersion tracking on existing instances. No schema or behavior changes.
2026.07.18.1
Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and
@aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency
freshness. No behavior change.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
2026.07.18.1
Changed: Bumped @aws-sdk/client-iam, @aws-sdk/client-sts, and
@aws-sdk/credential-providers from 3.1069.0 to 3.1090.0 for dependency
freshness. No behavior change.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
2026.07.16.1
Fixed: This extension was merged 2026-06-25 (#151) but never actually published — the publish workflow's change-detection missed the manifest version bump in that merge and picked up an unrelated concurrent branch instead. This release is the first real publish; there is no prior published version to compare against.
Added: Cross-account IAM observation model — trust map discovery, access key age tracking, and wildcard/GovCloud/bare-account ARN handling in trust relationships.
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License declared1/1earned
- Verified public repository2/2earned