Harden AWS IAM Security

Reviews and hardens IAM policies following AWS security best practices and least-privilege principles, anchored on three core commitments: least privilege (minimum needed permissions, managed policies over inline ones, no wildcard actions, regular reviews), defense in depth (MFA for all users, roles instead of long-term access keys, service control policies, CloudTrail enabled), and separation of duties (distinct admin and user roles, different roles per environment, approval workflows, regular permission audits). Concrete CLI checks scan for overly permissive policies by grepping policy documents for a bare wildcard action, flag inline policies attached directly to users that should be managed policies instead, list users lacking MFA from the credential report, check whether a policy actually enforces aws:MultiFactorAuthPresent, find access keys older than 90 days by comparing their creation date to today, identify IAM roles that have never been used, and flag roles whose trust policy grants access to an external AWS account. A rotate-access-key pattern creates the replacement key first, prints the exact command to delete the old one once applications are updated, and deactivates rather than immediately deletes the old key so it can be tested safely before final removal.

Four ready-made policy templates cover common hardening patterns, starting with least-privilege S3 access scoped to a user's own prefix via a policy variable:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject"],
      "Resource": "arn:aws:s3:::my-bucket/user-data/${aws:username}/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket",
      "Condition": {"StringLike": {"s3:prefix": "user-data/${aws:username}/*"}}
    }
  ]
}

plus an MFA-required policy that denies all actions unless MFA is present, a time-boxed policy that only grants EC2 access within a specific date range, and an IP-restricted policy denying all actions from outside two named CIDR ranges. A 20-item hardening checklist spans user management (MFA, unused user removal, 90-day key rotation, roles over long-term credentials, password policy), policy management (replacing inline policies, removing wildcards, least privilege, condition-based policies, regular reviews), role management (EC2 instance roles, cross-account trust review, unused role removal, session tags), and monitoring (CloudTrail for IAM events, CloudWatch alarms on IAM changes, IAM Access Analyzer, privilege-escalation monitoring). A companion Python script automates three of these checks directly against the IAM API - users without MFA, keys older than 90 days, and policies with a bare wildcard action - and prints a consolidated report.

Use it when IAM policies need reviewing, least privilege needs implementing, or IAM security generally needs hardening. Best practices reinforce using AWS managed policies where possible, versioning policies, testing changes in non-production first, documenting each policy's purpose, running access reviews quarterly, using IAM Access Analyzer, and layering service control policies for organization-wide guardrails on top of individual IAM policies.

Takes an AWS account's IAM configuration; produces a report of overpermissive policies, missing MFA, stale access keys, and unused roles, plus ready-to-apply least-privilege, MFA-required, time-boxed, or IP-restricted policy documents.

Teams auditing or hardening AWS IAM who want concrete CLI checks and ready-made policy templates rather than reading the best-practices documentation and writing checks from scratch.