AWS IAM Security Framework

Comprehensive AWS IAM security framework implementing least privilege, permission boundaries, ABAC, IAM Access Analyzer, and automated credential hygiene — preventing privilege escalation and credential compromise at enterprise scale.

Framework Components

Component	Purpose	Files
Permission Boundaries	Prevent privilege escalation	modules/permission-boundaries/
ABAC Policies	Tag-based dynamic least privilege	modules/iam-roles/abac.tf
Access Analyzer	Detect external access + unused permissions	modules/access-analyzer/
Credential Hygiene	Rotate/disable stale keys automatically	scripts/python/credential_hygiene.py
IAM Reporting	Weekly privilege report for all accounts	scripts/python/iam_report.py

Design Principles

1. No long-term credentials — Use IAM roles, not access keys, wherever possible
2. Permission boundaries on all delegated roles — Operators cannot grant themselves more than boundary allows
3. ABAC over RBAC — Tag-based policies scale to thousands of resources without policy updates
4. Just-in-time access — Use IAM Identity Center permission sets with time-limited sessions
5. Continuous analysis — Access Analyzer + IAM Findings in Security Hub

Quick Start

cd terraform/environments/prod
terraform init && terraform plan

Credential Hygiene Automation

# Report stale credentials (>90 days unused)
python3 scripts/python/credential_hygiene.py --report

# Disable credentials unused for >90 days
python3 scripts/python/credential_hygiene.py --remediate --dry-run

License

MIT License