IAM Policy Autopilot finally supports Terraform too!

Hey, it's Shii! Today I'm sharing something I found on AWS What's New. If you've ever groaned about writing IAM policies by hand, this one's for you!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced that the open source tool "IAM Policy Autopilot" can now generate IAM policies directly from a Terraform plan file.

IAM Policy Autopilot launched at re:Invent 2025, and it analyzes your code to automatically generate scoped-down IAM policies. It's a handy helper that cuts down the time you spend writing IAM policies by hand or chasing down access errors.

The story so far

Until now, IAM Policy Autopilot could analyze your application source code, but it couldn't generate IAM policies for infrastructure deployed through Infrastructure as Code tools like Terraform. It could analyze SDK calls readable from your app code, but it didn't handle the permissions needed when Terraform creates, changes, or deletes resources. This was actually the most requested capability since the tool launched.

What changes

You can now pass a Terraform plan file directly as input, and the tool applies deterministic analysis to generate a policy scoped to the CRUD operations (create, read, update, delete) of the resources in that plan. And the generated policies reference specific resource ARNs instead of wildcards whenever possible, making them safer and easier to read. It also works alongside the existing analysis that cross-references Terraform resource definitions with SDK calls in your application code to resolve ARNs.

Dive Deep

• It's free to use and runs on your own machine
• The input is a Terraform plan file, so you can check the policy before you even run apply
• The generated policy is meant as a baseline, so you're expected to refine it further as needed
• If you're curious, you can try it from the IAM Policy Autopilot GitHub repository

Wrap-up

• IAM Policy Autopilot now supports generating IAM policies from Terraform plan files
• It used to analyze only application source code, but now it can also handle policies for infrastructure deployed via IaC
• Generated policies are scoped to the resources' CRUD operations and use specific ARNs whenever possible
• It's free and runs in your own environment
• A great fit if you manage AWS resources with Terraform and find IAM policy management a hassle!