Registry / aws / policy-sentry

policy-sentry

JSON →
library0.15.2pypypi✓ verified 26d ago

Policy Sentry is an AWS IAM Least Privilege Policy Generator, auditor, and analysis database, currently at version 0.15.1. It compiles database tables based on the AWS IAM Documentation on Actions, Resources, and Condition Keys and leverages that data to create least-privilege IAM policies. It helps organizations limit the blast radius in the event of a breach and scale the creation of secure IAM policies. The project maintains an active release cadence with frequent updates.

pip install policy-sentry
INSTALL
IMPORT
SIG · POLICY-SENTRY
P
policy-sentry
awspythonv0.15.2
Install
3.2s avg
Import
Disk
38MB
Pass rate
10/ 10
Env Coverage10 / 10
glibc
3.93.13
musl
3.93.13
Install & Compatibility
Where this runs
tested against v0.15.2 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
musl
py 3.103.95 runs
installs and imports cleanly · install 0.0s · import 0.000s · 39MB
glibc
py 3.103.95 runs
installs and imports cleanly · install 3.2s · import 0.000s · 40MB
38MB installed
● package 38MB
Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

write_policy
from policy_sentry.writing.policy import write_policy
from policy_sentry.writing.policy import write_policy

This quickstart demonstrates how to programmatically define policy requirements using a dictionary structure similar to the CLI's YAML templates, and then generate a least-privilege AWS IAM policy in JSON format. It creates a policy allowing read and list access to a specific S3 bucket and its objects.

from policy_sentry.writing.policy import write_policy import json # Define the policy requirements using a dictionary that mirrors the YAML template structure policy_definition = { "mode": "crud", "name": "MyS3ReadPolicy", "read": [ "arn:aws:s3:::my-unique-bucket", "arn:aws:s3:::my-unique-bucket/*" ], "write": [], "list": [ "arn:aws:s3:::my-unique-bucket" ], "tagging": [], "permissions-management": [], "wildcard-only": { "single-actions": [], "service-read": [], "service-write": [], "service-list": [], "service-tagging": [], "service-permissions-management": [] }, "skip-resource-constraints": [], "exclude-actions": [] } # Generate the IAM policy output_policy = write_policy(policy_definition) print(json.dumps(output_policy, indent=4))
policy_sentry --version
Debug
Known issues
breakingPolicy Sentry has progressively dropped support for older Python versions. Version 0.15.x requires Python 3.10 or higher. Previous versions (0.14.x and 0.13.x) dropped support for Python 3.8 and 3.7, respectively.
fix
Ensure your environment uses Python >=3.10 when upgrading to policy-sentry 0.15.x.
affects: >=0.13.0
breakingIn version 0.13.0, significant internal changes occurred, including converting path constants from `str` to `Path` objects, removing deprecated code, and altering how AWS documentation is bundled within the wheel. Custom integrations or direct usage relying on these internal details or deprecated functions may break.
fix
Review the Policy Sentry GitHub releases and documentation for v0.13.0 to understand the specific changes and update any code that interacts with internal path structures or previously deprecated functions.
affects: >=0.13.0
gotchaWhen using Policy Sentry as a library, the IAM database is often bundled with the package, making explicit initialization via `policy_sentry initialize` optional for basic usage. However, to fetch the absolute latest AWS IAM data from the AWS website or to apply custom access level overrides, you still need to run `policy_sentry initialize --fetch`.
fix
If you require the most up-to-date IAM definitions or custom overrides, run `policy_sentry initialize --fetch` as a CLI command before using the library's querying or writing functions that depend on the database.
affects: All
Upgrade
Version history
0.15.2latest on PyPI · released Apr 14, 2026
Audit
Dependencies

No dependency data recorded yet.

Agent activity
34 hits · last 30 days
node
28
OpenAI (training)
1
Resources
policy-sentry — pip install policy-sentry · libregistry