[GH-ISSUE #153] Improve policy output: merge statements with equivalent resources and sort statements by service name #131

New issue

Open

opened 2026-03-07 19:42:29 +03:00 by kerem · 0 comments

kerem commented

2026-03-07 19:42:29 +03:00

Owner

Originally created by @mschlaipfer on GitHub (Feb 18, 2026).
Original GitHub issue: https://github.com/awslabs/iam-policy-autopilot/issues/153

Take the following policy

{
  "Policies": [
    {
      "Policy": {
        "Id": "IamPolicyAutopilot",
        "Version": "2012-10-17",
        "Statement": [
          {
            "Effect": "Allow",
            "Action": [
              "kms:Decrypt",
              "kms:GenerateDataKey"
            ],
            "Resource": [
              "arn:aws:kms:*:*:key/*"
            ],
            "Condition": {
              "StringLike": {
                "kms:ViaService": [
                  "s3.*.amazonaws.com"
                ]
              }
            }
          },
          {
            "Effect": "Allow",
            "Action": [
              "s3:GetObject",
              "s3:GetObjectAcl",
              "s3:GetObjectLegalHold",
              "s3:GetObjectRetention",
              "s3:GetObjectTagging",
              "s3:GetObjectVersion",
              "s3:PutObject",
              "s3:PutObjectAcl",
              "s3:PutObjectLegalHold",
              "s3:PutObjectRetention",
              "s3:PutObjectTagging"
            ],
            "Resource": [
              "arn:aws:s3:*:*:accesspoint/*/object/*",
              "arn:aws:s3:::*/*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "s3-object-lambda:GetObject",
              "s3-object-lambda:PutObject"
            ],
            "Resource": [
              "arn:aws:s3:*:*:accesspoint/*/object/*",
              "arn:aws:s3:::*/*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "dynamodb:PutItem",
              "dynamodb:Query",
              "dynamodb:UpdateItem",
              "dynamodb:WriteDataForReplication"
            ],
            "Resource": [
              "arn:aws:dynamodb:*:*:table/*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "kms:Decrypt"
            ],
            "Resource": [
              "arn:aws:kms:*:*:key/*"
            ],
            "Condition": {
              "StringLike": {
                "kms:ViaService": [
                  "dynamodb.*.amazonaws.com"
                ]
              }
            }
          },
          {
            "Effect": "Allow",
            "Action": [
              "s3:ListBucket"
            ],
            "Resource": [
              "arn:aws:s3:*:*:accesspoint/*",
              "arn:aws:s3:::*"
            ]
          },
          {
            "Effect": "Allow",
            "Action": [
              "s3-object-lambda:ListBucket"
            ],
            "Resource": [
              "arn:aws:s3:*:*:accesspoint/*",
              "arn:aws:s3:::*"
            ]
          }
        ]
      },
      "PolicyType": "Identity"
    }
  ]
}

We should output all kms and all s3 statements next to one another, respectively to make the policies easier to read/review.
Moreover, the s3-object-lambda statements could be merged with the s3 statements since they operate on the same resources, without impact on the permissions granted by the policy.

Originally created by @mschlaipfer on GitHub (Feb 18, 2026). Original GitHub issue: https://github.com/awslabs/iam-policy-autopilot/issues/153 Take the following policy ``` { "Policies": [ { "Policy": { "Id": "IamPolicyAutopilot", "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "s3.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:GetObjectAcl", "s3:GetObjectLegalHold", "s3:GetObjectRetention", "s3:GetObjectTagging", "s3:GetObjectVersion", "s3:PutObject", "s3:PutObjectAcl", "s3:PutObjectLegalHold", "s3:PutObjectRetention", "s3:PutObjectTagging" ], "Resource": [ "arn:aws:s3:*:*:accesspoint/*/object/*", "arn:aws:s3:::*/*" ] }, { "Effect": "Allow", "Action": [ "s3-object-lambda:GetObject", "s3-object-lambda:PutObject" ], "Resource": [ "arn:aws:s3:*:*:accesspoint/*/object/*", "arn:aws:s3:::*/*" ] }, { "Effect": "Allow", "Action": [ "dynamodb:PutItem", "dynamodb:Query", "dynamodb:UpdateItem", "dynamodb:WriteDataForReplication" ], "Resource": [ "arn:aws:dynamodb:*:*:table/*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": [ "arn:aws:kms:*:*:key/*" ], "Condition": { "StringLike": { "kms:ViaService": [ "dynamodb.*.amazonaws.com" ] } } }, { "Effect": "Allow", "Action": [ "s3:ListBucket" ], "Resource": [ "arn:aws:s3:*:*:accesspoint/*", "arn:aws:s3:::*" ] }, { "Effect": "Allow", "Action": [ "s3-object-lambda:ListBucket" ], "Resource": [ "arn:aws:s3:*:*:accesspoint/*", "arn:aws:s3:::*" ] } ] }, "PolicyType": "Identity" } ] } ``` We should output all `kms` and all `s3` statements next to one another, respectively to make the policies easier to read/review. Moreover, the `s3-object-lambda` statements could be merged with the `s3` statements since they operate on the same resources, without impact on the permissions granted by the policy.