AWS First Steps
New feature

IAM Policy Autopilot now supports Terraform plan files

IAM Policy Autopilot can now generate baseline IAM policies directly from Terraform plan files, producing policies scoped to resource CRUD functions with specific ARNs when possible

IAM Policy Autopilot, an open source tool launched at re:Invent 2025, previously analyzed application source code to create scoped-down IAM policies. It now accepts Terraform plan files as input, applying deterministic analysis to produce policies scoped to the CRUD functions of resources in that plan. Generated policies reference specific resource ARNs rather than wildcards when possible. This capability has been the most requested feature since launch and complements existing Terraform-aware analysis that cross-references Terraform resource definitions with SDK calls in application code to resolve ARNs. IAM Policy Autopilot is available at no additional cost and runs on your own machine. Visit the IAM Policy Autopilot GitHub repository to get started

Why it matters

This update is relevant for developers and DevOps engineers who deploy AWS infrastructure defined with Terraform, automating IAM policy generation for such deployments

Read the original AWS announcement

Related articles and terms

IAM Access AnalyzerA service that automatically analyzes resource policies on S3 buckets, IAM roles, and more to detect external access and unused permissions, strengthening your security postureDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesAWS IAM Fine-Grained Access Control - How Policy-Based Design Achieves the Principle of Least PrivilegeExplore the design philosophy behind AWS IAM's policy-based access control and compare its granularity with Azure RBAC and GCP IAM in concrete terms.