Cloudsplaining

Cloudsplaining is an AWS IAM security assessment tool that finds policies violating least privilege. It scans a single policy file or every policy in an AWS account, then generates a polished HTML report with a triage worksheet to help you prioritize remediation.

It flags policies that present risks including data exfiltration, infrastructure modification, resource exposure, and privilege escalation. It also identifies IAM roles assumable by AWS compute services such as EC2, ECS, EKS, and Lambda, which can present greater risk than user-defined roles. A custom exclusions file lets you filter out context-dependent false positives.

Run it from the command line to download account authorization details and scan them locally, producing both the HTML report and a raw JSON data file. A scan-multi-account command can assume a common role across many accounts and write results to an S3 bucket.