What I Built
As a Cloud Architect, the principle of Least Privilege is my guiding star, but writing manual IAM policies is often a bottleneck that leads to "security debt." I built IAM Sentinel an AI powered agentic framework that bridges the gap between high-level architectural requirements and verified cloud security code.
IAM Sentinel uses the GitHub Copilot CLI to "reason" through security scenarios and generate precise JSON policies. To ensure these policies aren't just plausible but technically sound, I integrated a validation layer using Boto3 and the AWS IAM Policy Simulator, creating a complete "Generate -> Validate -> Report" cycle for security-as-code.
Demo
The project is fully open-sourced and documented to be "cloned and run" for anyone with AWS credentials and the Copilot CLI.
Figure 1: GitHub Copilot CLI reasoning through the S3 scenario.
Figure 2: Automated validation via Boto3 and AWS IAM Policy Simulator proving the policy is functionally correct.
Figure 3: The final generated Markdown audit report summarizing the verified permissions for stakeholders.
🔗 GitHub Repository: https://github.com/mpawar006/iam-sentinel
Sentinel in Action
The Request: python iam_sentinel.py --scenario s3_read_write
The Logic: Copilot CLI analyzes the scenario and generates a scoped policy distinguishing between bucket-level (ListBucket) and object-level (GetObject/PutObject) permissions.
The Proof: The tool automatically triggers the AWS Policy Simulator to verify the JSON.
Sample Audit Report Output:
| AWS Action | Resource Target | Status |
|---|---|---|
| s3:ListBucket | arn:aws:s3:::sentinel-data-storage |
✅ ALLOWED |
| s3:GetObject | arn:aws:s3:::sentinel-data-storage/test.txt |
✅ ALLOWED |
My Experience with GitHub Copilot CLI
Integrating the GitHub Copilot CLI into a Python automation suite was a masterclass in modern agentic development.
Impact on Speed: I spent significantly less time looking up specific S3 Action names (was it s3:List or s3:ListBucket?). Copilot handled the "syntax heavy lifting," allowing me to focus on the architectural logic.
Prompting as Architecture: I used Copilot not just for code completion, but as a Reasoning Engine. By passing structured scenarios from a policy_library.json, I was able to treat the CLI as a programmatic backend for security decisions.
Overcoming Hurdles: I encountered some syntax evolutions with the -i and -p flags in the 2026 version of the CLI. Debugging these through subprocess gave me a deeper understanding of how the Copilot extension manages interactive vs. non-interactive sessions, eventually settling on a robust wrapper that ensures reliable execution.
Top comments (0)