IAM Policy Autopilot now supports Terraform plan files

IAM Policy Autopilot, an open-source tool introduced at re:Invent 2025, previously analyzed application source code to create scoped-down IAM policies. The tool has now expanded its capabilities to process Terraform plan files, allowing users to generate policies tailored to the resources defined in their infrastructure-as-code deployments. This update addresses a key user request since the tool's launch, bridging a gap in policy generation for AWS infrastructure managed via Terraform.

The new feature analyzes Terraform plan files to produce deterministic IAM policies that align with the CRUD (Create, Read, Update, Delete) operations required by the resources in the plan. Policies are generated with specific resource ARNs where possible, reducing reliance on broad wildcard permissions. This approach enhances security by ensuring least-privilege access for infrastructure deployments, aligning with AWS's emphasis on minimizing unnecessary permissions.

Previously, IAM Policy Autopilot could cross-reference Terraform resource definitions with SDK calls in application code to resolve ARNs, but it could not generate policies directly from Terraform plan files. The update enables a more streamlined workflow for users who manage AWS infrastructure using Terraform, eliminating the need to manually write or refine policies for each deployment. The tool remains available at no additional cost and operates locally on the user's machine.

To use the new feature, users can pass a Terraform plan file as input to IAM Policy Autopilot, which will output a policy scoped to the resources in the plan. The tool is accessible via the IAM Policy Autopilot GitHub repository, where users can find documentation and instructions for implementation. This enhancement reflects AWS's ongoing efforts to simplify IAM policy management while maintaining security best practices.