IAM Sentinel: Bridging AI Reasoning with AWS Security Compliance

What I Built

As a Cloud Architect, the principle of Least Privilege is my guiding star, but writing manual IAM policies is often a bottleneck that leads to "security debt." I built IAM Sentinel an AI powered agentic framework that bridges the gap between high-level architectural requirements and verified cloud security code.

IAM Sentinel uses the GitHub Copilot CLI to "reason" through security scenarios and generate precise JSON policies. To ensure these policies aren't just plausible but technically sound, I integrated a validation layer using Boto3 and the AWS IAM Policy Simulator, creating a complete "Generate -> Validate -> Report" cycle for security-as-code.

Demo

The project is fully open-sourced and documented to be "cloned and run" for anyone with AWS credentials and the Copilot CLI.

🔗 GitHub Repository: https://github.com/mpawar006/iam-sentinel

Sentinel in Action

1. The Request: python iam_sentinel.py --scenario s3_read_write




2. The Logic: Copilot CLI analyzes the scenario and generates a scoped policy distinguishing between bucket-level (ListBucket) and object-level (GetObject/PutObject) permissions.




3. The Proof: The tool automatically triggers the AWS Policy Simulator to verify the JSON.

Sample Audit Report Output: | AWS Action | Resource Target | Status | | :--- | :--- | :--- | | s3:ListBucket | arn:aws:s3:::sentinel-data-storage | ✅ ALLOWED | | s3:GetObject | arn:aws:s3:::sentinel-data-storage/test.txt | ✅ ALLOWED |

My Experience with GitHub Copilot CLI

Integrating the GitHub Copilot CLI into a Python automation suite was a masterclass in modern agentic development.

• Impact on Speed: I spent significantly less time looking up specific S3 Action names (was it s3:List or s3:ListBucket?). Copilot handled the "syntax heavy lifting," allowing me to focus on the architectural logic.




• Prompting as Architecture: I used Copilot not just for code completion, but as a Reasoning Engine. By passing structured scenarios from a policy_library.json, I was able to treat the CLI as a programmatic backend for security decisions.




• Overcoming Hurdles: I encountered some syntax evolutions with the -i and -p flags in the 2026 version of the CLI. Debugging these through subprocess gave me a deeper understanding of how the Copilot extension manages interactive vs. non-interactive sessions, eventually settling on a robust wrapper that ensures reliable execution.