[IXI-2773]

AWS IAM Policy Reviewer — original offline defensive tool

Included

• Python standard-library CLI for a bounded identity-policy JSON subset. It performs no AWS calls or credential handling.
• Literal Allow-statement candidates: unrestricted Action/Resource, iam:PassRole on all resources, sts:AssumeRole on all resources, and service-wide wildcards including hyphenated AWS namespaces such as execute-api:*.
• AWS action-name case-insensitive matching for exact PassRole/AssumeRole; independent findings when a mixed action list contains multiple patterns.
• Fail-closed handling of unsupported policy elements, malformed field types, duplicate JSON object keys, and invalid input. Condition is recorded as present but not evaluated.
• Fully fabricated baseline and proposed narrow IAM policies, with retained byte-matching JSON results, and interview case study focused on wildcard role assumption (1 modeled candidate → 0).
• Clear conceptual attribution without copied third-party source.

Scientific and security scope

• Synthetic only: no AWS account, principal, live resource, cloud access, deployed remediation or actual privilege escalation is claimed.
• Literal review candidates are not effective-permission simulation. The reviewer does not evaluate Conditions, deny policies, trust policies, SCPs, boundaries, session/resource policies, or AWS action expansion. No finding does not certify least privilege.

Independent review and focused proof

• Independent review identified two medium issues: missed hyphenated namespaces and duplicate-key JSON ambiguity. Both addressed test-first in subsequent commits.
• 10 IAM-focused tests pass, including regression tests that failed before each correction; all four retained synthetic reports reproduce byte-for-byte.
• python scripts/check_catalog.py: 314 local Markdown destinations; 41 Python files parse.
• git diff --check clean. GitHub catalog CI must be green on this latest head before merge.
• No full test suite run, per repository policy.

Publication

• Employer-facing portfolio case prepared in portfolio PR #34, with exact source-linked evidence.

Ready for owner merge decision after required checks.