IAM策略自动驾驶仪

Network Requirements

IAM Policy Autopilot makes HTTPS requests at runtime to the AWS service reference endpoint to fetch up-to-date AWS service metadata used for policy generation. This endpoint must be reachable from the machine running the tool.

Prerequisites

• Rust (latest stable version)
• Git
• Python 3
• CMake (Windows only)

Getting Started

Installation

Option 1: Using uv (Recommended)

Install uv from Astral.

No additional installation needed - you can run IAM Policy Autopilot directly using uvx iam-policy-autopilot.

Option 2: Using pip

Install pip.

pip install iam-policy-autopilot

Option 3: Direct installation (MacOS/Linux only)

To install the latest release directly, run the following script to download and install as a system utility.

curl -sSL https://github.com/awslabs/iam-policy-autopilot/raw/refs/heads/main/install.sh | sudo sh

This will install the latest release directly to /usr/local/bin/iam-policy-autopilot.

Build Instructions

Setup

Clone the repository with submodules:

git clone --recurse-submodules https://github.com/awslabs/iam-policy-autopilot.git
cd iam-policy-autopilot

Build the project:

cargo build --release

The compiled binary will be located at target/release/iam-policy-autopilot.

Building Release Version

cargo build --release

The compiled binary will be located at target/release/iam-policy-autopilot.

CLI Usage

The iam-policy-autopilot CLI tool provides three main commands:

Generate IAM policies from source code and fix AccessDenied errors

Usage: iam-policy-autopilot <COMMAND>

Commands:
  fix-access-denied  Fix AccessDenied errors by analyzing and optionally applying IAM policy changes
  generate-policies    Generates complete IAM policy documents from source files
  mcp-server         Start MCP server
  help               Print this message or the help of the given subcommand(s)

Options:
  -h, --help     Print help (see more with '--help')
  -V, --version  Print version

AWS Configuration

IAM Policy Autopilot requires AWS credentials to apply policy fixes and upload policies for AccessDenied debugging.

Install AWS CLI and configure your AWS credentials.

For more information on AWS credential configuration, see the AWS CLI Configuration Guide.

MCP Server Configuration

Configure the MCP server in your MCP client configuration to enable your AI coding assistant to generate IAM policies.

For Kiro

Get Kiro from https://kiro.dev/

If using uv/uvx:

Add the following configuration to your project-level .kiro/settings/mcp.json:

{
  "mcpServers": {
    "iam-policy-autopilot": {
      "command": "uvx",
      "args": ["iam-policy-autopilot", "mcp-server"],
      "env": {
        "AWS_PROFILE": "your-profile-name",
        "AWS_REGION": "us-east-1"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

If using pip:

{
  "mcpServers": {
    "iam-policy-autopilot": {
      "command": "iam-policy-autopilot",
      "args": ["mcp-server"],
      "env": {
        "AWS_PROFILE": "your-profile-name",
        "AWS_REGION": "us-east-1"
      },
      "disabled": false,
      "autoApprove": []
    }
  }
}

For Kiro CLI

Get Kiro CLI from https://kiro.dev/cli

Kiro Cli uses the same configuration as Kiro mentioned above, additionally, MCPs for Kiro CLI can also be setup via:

If using uv/uvx:

kiro-cli mcp add \
  --name iam-policy-autopilot \
  --command "uvx" \
  --args "iam-policy-autopilot","mcp-server"

If using pip:

kiro-cli mcp add \
  --name iam-policy-autopilot \
  --command "iam-policy-autopilot" \
  --args "mcp-server"

For Claude Desktop

Add to your Claude Desktop configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

Windows: %APPDATA%\Claude\claude_desktop_config.json

Linux: ~/.config/Claude/claude_desktop_config.json

If using uv/uvx:

{
  "mcpServers": {
    "iam-policy-autopilot": {
      "command": "uvx",
      "args": ["iam-policy-autopilot", "mcp-server"],
      "env": {
        "AWS_PROFILE": "your-profile-name",
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

If using pip:

{
  "mcpServers": {
    "iam-policy-autopilot": {
      "command": "iam-policy-autopilot",
      "args": ["mcp-server"],
      "env": {
        "AWS_PROFILE": "your-profile-name",
        "AWS_REGION": "us-east-1"
      }
    }
  }
}

Kiro Power Configuration

IAM Policy Autopilot has an associated Kiro power configuration inside the power-iam-policy-autopilot directory. This can be used to install a corresponding Kiro power in your Kiro editor.

Enabling the IAM Policy Autopilot Kiro Power

To enable the IAM Policy Autopilot Kiro Power, first install the uv package manager by following these instructions. Then, do the following steps within Kiro: 1. Go to the "Powers" menu in the menubar on the left-hand-side. 2. Click Add Custom Power -> Import power from Github 3. In the text prompt that then appears, enter https://github.com/awslabs/iam-policy-autopilot/tree/main/power-iam-policy-autopilot. 4. Kiro should automatically install a new Kiro power called IAM Policy Autopilot within your Kiro code editor. This power should be visible in the Powers menu.

If the above steps for installing the power from a GitHub repository URL does not work, you can also clone the repository and import the power directly, by doing the following: 1. Clone the git repository https://github.com/awslabs/iam-policy-autopilot, and remember the directory to where you cloned the repo. 2. Go to the "Powers" menu in the menubar on the left-hand-side. 3. Click Add Custom Power -> Import power from a folder 4. In the text prompt that then appears, select the power-iam-policy-autopilot folder in your cloned repository. For instance, if the repository is cloned to ~/workplace/iam-policy-autopilot, you should select or enter ~/workplace/iam-policy-autopilot/power-iam-policy-autopilot. 5. Kiro should automatically install a new Kiro power called IAM Policy Autopilot within your Kiro code editor. This power should be visible in the Powers menu.

Why use IAM Policy Autopilot's Kiro Power?

Kiro powers generally offer a more refined experience than traditional MCP servers because they enable MCP tools to be loaded more selectively & deliberately, reducing LLM token usage and avoiding LLM context overcrowding.

IAM Policy Autopilot's Kiro power specifically enhances the traditional MCP experience, for multiple reasons: 1. This Kiro Power provides your LLM agent with more steering guidance, offering it more information on the specific use cases and best practices of our MCP tooling. 2. This Kiro power prompts your LLM agent to give a tutorial of the MCP tools offered by IAM Policy Autopilot, allowing you to better understand how our MCP tooling assists your use case. 3. This Kiro Power provides your LLM agent with step-by-step onboarding validation, allowing it to detect any problems with installations and provide remediation steps for those problems.

Supported Languages and SDKs for policy generation

Run integration tests

cargo test -p iam-policy-autopilot-cli --test integration_tests ```