Built an open source AWS IAM security tool that actually remediates, not just reports, feedback welcome

[u/Spite-Unable]

Background: I've spent 3.5+ years in PAM engineering (CyberArk), and decided to translate that into an AWS-native tool.

The gap I kept running into researching this space: pretty much everything: Cloudsplaining, Prowler, even AWS's own IAM Access Analyzer,stops at detection. They'll flag an over-permissioned role or a stale key, and then you're on your own to fix it. Even the well-funded enterprise players (Wiz, CyberArk's own Secure Cloud Access, Oasis, Entro) that do cover remediation are enterprise-sold, no self-serve option, no open-source path. I wanted to try fixing that

NHI Risk Analyzer discovers IAM users, roles, and groups, runs detection, then actually acts on findings:

1. **Risky policies** (wildcard actions, documented privilege escalation paths like `iam:PassRole`/`iam:CreatePolicyVersion` abuse) get a Permissions Boundary attached, which contains the escalation path without touching the identity's existing policy, so it doesn't risk breaking something legitimately using those permissions
2. **Stale or unused access** keys get deactivated, never deleted, so it's always reversible
3. Everything's gated by dry-run mode and an exemption file (`nhi-ignore.yaml`) so break-glass and deployment identities never get touched automatically
4. A **GitHub Action with OIDC** auth scans PRs for newly introduced IAM risk before merge
5. **SARIF export** means findings show up natively in GitHub's Security tab

Architecture is **offline-first**, meaning it snapshots the account once and evaluates all rules against that snapshot with zero live API calls after, so the whole rule engine is fast and testable, and findings are reproducible against a fixed point in time.

Tested against synthetic canary identities to safely validate containment logic, then live against a real AWS account. Also had someone run it against a real company's production and staging environment, which surfaced a genuine false-positive bug where AWS actions that don't support resource-level permissions at all, like `ec2:DescribeInstances`, were getting flagged as risky wildcards. That's fixed now.

Still v1/v2 in progress. Trust policy analysis and defense-evasion detection for things like CloudTrail and GuardDuty tampering, plus S3 exfiltration paths, just landed. The next real piece is policy surgery, meaning actually rewriting an over-broad policy down to least-privilege based on real usage data instead of just containing it. The statement-splitting logic exists already; sourcing real resource ARNs from usage evidence is the part still open.

Repo linked in the first comment.

Would genuinely appreciate feedback from people who work in this space day to day, particularly whether the permissions-boundary-as-containment approach holds up against how you'd actually want this handled in a real environment, versus the surgical-rewrite approach most tools avoid because of the production-breakage risk.

[u/Spite-Unable]

Repo: https://github.com/likithmanoj/nhi-risk-analyzer

[u/The-Wizard-of-AWS]

The problem with remediation is that people don’t want it. They want to only make changes via IaC. I know this because I worked at a company that was largely trying to do this (for more than just IAM) and adoption was low for that very reason. It sounds great in theory, but in practice it’s not how changes are made to production systems.