BObobbiechen·Jan 29, 2025Submission
Iamlive: Generate IAM policy from AWS calls using client-side monitoring (CSM)
1 points · Open discussioniann0036
iamlive
Go2021–2025
iann0036 / iamlive
iamlive
Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy
9Distinct people
9Mentions
0Explicit recommenders
3.4KGitHub stars
What to know before exploring
What it is
Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy
GitHub
Where it is used
No documented product use has been verified yet.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 5:04:57 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year9 dated mentions
Observed mentions: 2021-02-06 12:28:48 UTC to 2025-01-29 19:46:27 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 1 | 1 | 0 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 2 | 1 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
9 sourcesGenerate an AWS, Azure, or GCP IAM policy using client-side monitoring
1 points · Open discussionThe author mentions building this solution multiple times, but doesn't link to any resources as far as I can tell, so here's the one I've used in the past [1].
In one mode, it proxies all your app's API calls and tells you exactly what permissions you need.
[1] https://github.com/iann0036/iamlive
In IAM Is the WorstYeah, what you are looking for is something like a "learning mode" for an IAM account where the key actually has wide-open permissions and the system records which permissions are used and generates a policy locked down to what you did while it was in "learning mode" then you can edit that policy and then turn the account into "locked mode" where permissions are limited to the created policy.
I've been in that position and more often than not I end up doing the "wrong" thing and give a key wider permissions than needed because trying to lock it down is so frustrating (especially if your CI process is long/expensive). Having to wait 5+ minutes for a CI to reach to the end and realized you missed 1 permissions, rinse and repeat 10+ times for "just one more permission" is frustrating/time consuming.
EDIT: Just saw this further down in the th
Read the rest
read https://github.com/iann0036/iamlive (which you already replied to) which looks like it does pretty much what I'm looking for.
actually Ian (aws hero) has a tool that does exactly this
https://github.com/iann0036/iamlive
In AWS Creates New Policy-Based Access Control Language CedarI have used https://github.com/iann0036/iamlive with great success in the past. On high level, the approach you are describing is iamlive on steroids and UX improved.
Kudos on launch, will check your beta
In Launch HN: Slauth.io (YC S22) – IAM Policy Auto-GenerationHow would you compare your offering to https://github.com/iann0036/iamlive (an opensource implementation of IAM generation from client-side monitoring or proxy, released in Feb 2021)?
In Launch HN: Slauth.io (YC S22) – IAM Policy Auto-GenerationIAM isn’t fun, but there’s lots of options.
https://pypi.org/project/access-undenied-aws/ will allow you to start with least privilege and fix specific issues.
https://github.com/iann0036/iamlive allows an admin to perform the action via CLI and capture the policy.
Access advisor can inspect how you actually use the role and give suggestions on what to remove.
A more helpful suggestion is to experiment with these tools and then find gaps in IAM actions and submit those as feature requests via your TAM.
In The End of CIIamlive – Generate an IAM policy from AWS client-side monitoring
81 points · Open discussion