boogy/IAM Validator
Validate AWS IAM policies for correctness and security. Standalone action with built-in checks and AWS Access Analyzer.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 6, 2026
- License
- MIT
Pinned Snippet
uses: boogy/iam-policy-validator@7be328de3172fa6e3667b5ba81ca9372b730420a # v1.21.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path(s) to IAM policy JSON/YAML file or directory (relative to repository root). For multiple paths, use newline-separated values | yes | — |
| config-file | Path to custom configuration file (iam-validator.yaml) | no | "" |
| fail-on-warnings | Fail validation if warnings are found (default: only fail on errors) | no | false |
| post-comment | Post validation results as PR comment | no | true |
| create-review | Create line-specific review comments on PR (requires post-comment: true) | no | true |
| off-diff-comment-mode | How to handle findings on unchanged lines: 'summary_only' (default), 'individual', or 'modified_statements_only' | no | summary_only |
| comment-tag | Optional run scope (1-32 chars, [A-Za-z0-9._-]) appended to PR summary, review, analyzer, and ignored-findings markers. Use a different tag per parallel run on the same PR (e.g. 'policy', 'role', 'scp') so comments do not overwrite each other. | no | "" |
| allow-owner-ignore | Allow CODEOWNERS to ignore findings by replying 'ignore' to review comments | no | true |
| github-summary | Write summary to GitHub Actions job summary (visible in Actions tab) | no | false |
| show-console-output | Show enhanced validation results in job logs (CI mode). Set to 'false' to suppress console output | no | true |
| format | Output format (console, enhanced, json, markdown, sarif, csv, html) | no | console |
| output-file | Path to save output file (for json, markdown, sarif, csv, html formats) | no | "" |
| upload-sarif | Upload SARIF results to GitHub Code Scanning (requires format: sarif and output-file to be set) | no | false |
| recursive | Recursively search directories for policy files | no | true |
| stream | Process files one-by-one (memory efficient for large repos with many policies) | no | false |
| batch-size | Number of policies to process per batch when streaming (default: 10) | no | 10 |
| summary | Show Executive Summary section in enhanced format output | no | false |
| severity-breakdown | Show Issue Severity Breakdown section in enhanced format output | no | false |
| use-access-analyzer | Use AWS IAM Access Analyzer for validation (requires AWS credentials) | no | false |
| access-analyzer-region | AWS region for Access Analyzer (default: us-east-1) | no | us-east-1 |
| policy-type | Policy type (IDENTITY_POLICY, RESOURCE_POLICY, TRUST_POLICY, SERVICE_CONTROL_POLICY, RESOURCE_CONTROL_POLICY) | no | IDENTITY_POLICY |
| run-all-checks | Run custom checks after Access Analyzer (only if use-access-analyzer: true) | no | false |
| check-access-not-granted | Actions that should NOT be granted (space-separated, max 100). Example: 's3:DeleteBucket iam:CreateAccessKey' | no | "" |
| check-access-resources | Resources to check with check-access-not-granted (space-separated, max 100). Example: 'arn:aws:s3:::prod-* arn:aws:iam::*:role/*' | no | "" |
| check-no-new-access | Path to existing/baseline policy to compare against for new access checks (relative to repository root) | no | "" |
| check-no-public-access | Check that resource policies do not allow public access (RESOURCE_POLICY only) | no | false |
| public-access-resource-type | Resource type(s) for public access check. Use 'all' to check all 29 types, or specify space-separated types. Options: all, AWS::S3::Bucket, AWS::Lambda::Function, AWS::KMS::Key, AWS::SNS::Topic, AWS::SQS::Queue, etc. | no | AWS::S3::Bucket |
| custom-checks-dir | Path to directory containing custom validation checks (relative to repository root). WARNING: every .py file in the directory is executed — never enable for workflows that run on untrusted forks (e.g. pull_request_target) | no | "" |
| aws-services-dir | Path to directory containing pre-downloaded AWS service definitions for offline mode (relative to repository root). Use 'iam-validator download-services' to create this directory. When specified, disables automatic caching and API calls. | no | "" |
| log-level | Logging level (debug, info, warning, error, critical) | no | warning |
| github-token | GitHub token for posting comments and reviews. Defaults to automatic github.token | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| validation-result | Validation result (success or failure) |
| total-policies | Total number of policies validated |
| valid-policies | Number of valid policies |
| invalid-policies | Number of invalid policies |
| total-issues | Total number of issues found |