11.4AWS IAM Access Analyzer Integration

Beyond static analysis, AWS IAM Access Analyzer can validate policies at runtime:

import boto3

def test_policy_with_access_analyzer():
    """Use AWS IAM Access Analyzer to validate policy documents."""
    client = boto3.client("accessanalyzer")

    with open("terraform/policies/lambda-execution-role.json") as f:
        policy_document = f.read()

    response = client.validate_policy(
        policyDocument=policy_document,
        policyType="IDENTITY_POLICY",
    )

    errors = [
        finding for finding in response["findings"]
        if finding["findingType"] == "ERROR"
    ]
    warnings = [
        finding for finding in response["findings"]
        if finding["findingType"] == "WARNING"
    ]
    security_warnings = [
        finding for finding in response["findings"]
        if finding["findingType"] == "SECURITY_WARNING"
    ]

    assert len(errors) == 0, f"Policy has errors: {errors}"
    assert len(security_warnings) == 0, f"Policy has security warnings: {security_warnings}"

    if warnings:
        for w in warnings:
            print(f"  WARNING: {w['issueCode']}: {w['message']}")