@@ -15,6 +15,7 @@
 """AWS IAM MCP Server implementation."""
 
 import argparse
+import fnmatch
 import json
 import re
 from awslabs.iam_mcp_server.aws_client import get_iam_client
@@ -78,6 +79,54 @@ def _check_denied_policy_arn(policy_arn: str) -> None:
 # Matches a service-scoped action wildcard such as 'iam:*' or 's3:*'.
 _SERVICE_WILDCARD_RE = re.compile(r'^[a-zA-Z0-9\-]+:\*$')
 
+# Matches an IAM resource-type-wide wildcard such as 'arn:aws:iam::123456789012:role/*'
+# or 'arn:aws-us-gov:iam::*:user/*', which covers every principal of that type.
+_IAM_RESOURCE_TYPE_WILDCARD_RE = re.compile(r'^arn:[^:]+:iam::[^:]*:[a-z-]+/\*$')
+
+# Named IAM actions that let the grantee escalate their own privileges without any
+# other permission (Rhino Security Labs / Cloudsplaining single-action methods), plus
+# iam:PassRole, which escalates when paired with any compute service, and the
+# permissions-boundary actions, which can lift a principal's own permission cap.
+# Stored lowercased because IAM action names are case-insensitive.
+PRIVILEGE_ESCALATION_ACTIONS = frozenset(
+    {
+        'iam:addusertogroup',
+        'iam:attachgrouppolicy',
+        'iam:attachrolepolicy',
+        'iam:attachuserpolicy',
+        'iam:createaccesskey',
+        'iam:createloginprofile',
+        'iam:createpolicyversion',
+        'iam:deleterolepermissionsboundary',
+        'iam:deleteuserpermissionsboundary',
+        'iam:passrole',
+        'iam:putgrouppolicy',
+        'iam:putrolepermissionsboundary',
+        'iam:putrolepolicy',
+        'iam:putuserpermissionsboundary',
+        'iam:putuserpolicy',
+        'iam:setdefaultpolicyversion',
+        'iam:updateassumerolepolicy',
+        'iam:updateloginprofile',
+    }
+)
+
+
+def _as_list(value: Any) -> Any:
+    """Normalize a policy element that may be a single string or a list of strings."""
+    return [value] if isinstance(value, str) else value
+
+
+def _matching_privilege_escalation_actions(patterns: List[str]) -> set:
+    """Return the privilege-escalation actions matched by the given action patterns.
+
+    Patterns may contain IAM wildcards ('*', '?'), e.g. 'iam:Put*' or 'iam:*Policy'.
+    """
+    lowered = [p.strip().lower() for p in patterns]
+    return {
+        a for a in PRIVILEGE_ESCALATION_ACTIONS if any(fnmatch.fnmatchcase(a, p) for p in lowered)
+    }
+
 
 def _check_wildcard_policy(policy_document: str) -> None:
     """Reject policy documents that grant overly broad access.
@@ -87,6 +136,19 @@ def _check_wildcard_policy(policy_document: str) -> None:
     ARN ending in ':*'). Checking only the literal '*'/'*' pair let equivalent grants
     such as Action 'iam:*' with Resource '*' through, which is still a full
     privilege-escalation primitive.
+
+    NotAction and NotResource are inverse matches ("everything except ..."), so they
+    count as a broad Action and a broad Resource respectively, whatever they list. A
+    finite exclusion list still leaves an unbounded grant, including actions and
+    resources that don't exist yet. They are rejected only when paired with the other
+    broad half: NotAction scoped to a specific resource ARN is still allowed, as is a
+    specific action with NotResource (no broader than that action on Resource '*').
+
+    Named IAM privilege-escalation actions (see PRIVILEGE_ESCALATION_ACTIONS), including
+    those reached through partial wildcards such as 'iam:Put*' or through NotAction, are
+    functionally equivalent to 'iam:*' for identity management. They are rejected on a
+    broad Resource or on every principal of a type (e.g. 'role/*'), and remain allowed
+    when scoped to specific principal ARNs.
     """
     doc = json.loads(policy_document)
     statements = doc.get('Statement', [])
@@ -95,25 +157,41 @@ def _check_wildcard_policy(policy_document: str) -> None:
     for stmt in statements:
         if stmt.get('Effect') != 'Allow':
             continue
-        actions = stmt.get('Action', [])
-        resources = stmt.get('Resource', [])
-        if isinstance(actions, str):
-            actions = [actions]
-        if isinstance(resources, str):
-            resources = [resources]
-
-        has_broad_action = any(a == '*' or _SERVICE_WILDCARD_RE.match(a) for a in actions)
-        has_broad_resource = any(
+        actions = _as_list(stmt.get('Action', []))
+        resources = _as_list(stmt.get('Resource', []))
+
+        has_broad_action = 'NotAction' in stmt or any(
+            a == '*' or _SERVICE_WILDCARD_RE.match(a) for a in actions
+        )
+        has_broad_resource = 'NotResource' in stmt or any(
             r == '*' or r == 'arn:*' or (r.startswith('arn:') and r.endswith(':*'))
             for r in resources
         )
 
         if has_broad_action and has_broad_resource:
             raise IamValidationError(
-                'Policy contains overly broad Action (wildcard or service:*) with broad Resource. '
+                'Policy contains overly broad Action (wildcard, service:*, or NotAction) with '
+                'broad Resource (wildcard or NotResource). '
                 'Please scope the policy to specific actions and resources.'
             )
 
+        if 'NotAction' in stmt:
+            escalation_actions = PRIVILEGE_ESCALATION_ACTIONS - (
+                _matching_privilege_escalation_actions(_as_list(stmt['NotAction']))
+            )
+        else:
+            escalation_actions = _matching_privilege_escalation_actions(actions)
+        has_principal_wide_resource = has_broad_resource or any(
+            _IAM_RESOURCE_TYPE_WILDCARD_RE.match(r) for r in resources
+        )
+
+        if escalation_actions and has_principal_wide_resource:
+            raise IamValidationError(
+                f'Policy grants IAM privilege-escalation actions {sorted(escalation_actions)} '
+                'on a broad Resource. Scope these actions to specific resource ARNs, or use '
+                'the AWS Console for high-privilege policy changes.'
+            )
+
 
 def _check_trust_policy_principal(policy_document: str) -> None:
     """Reject trust policies that allow any AWS principal."""
 
@@ -1736,6 +1736,198 @@ async def test_put_user_policy_allows_service_wildcard_with_scoped_resource():
         assert 'Successfully' in result.message
 
 
+@pytest.mark.asyncio
+@pytest.mark.parametrize('tool_name', ['put_user_policy', 'put_role_policy'])
+@pytest.mark.parametrize(
+    'stmt',
+    [
+        {'Effect': 'Allow', 'NotAction': 'iam:*', 'Resource': '*'},
+        {'Effect': 'Allow', 'NotAction': ['iam:*', 'sts:*', 'organizations:*'], 'Resource': '*'},
+        {'Effect': 'Allow', 'NotAction': 's3:DeleteBucket', 'Resource': 'arn:*'},
+        {'Effect': 'Allow', 'NotAction': 'iam:*', 'Resource': ['arn:aws:s3:::a', '*']},
+        {'Effect': 'Allow', 'Action': '*', 'NotResource': 'arn:aws:s3:::protected-bucket'},
+        {'Effect': 'Allow', 'Action': 'iam:*', 'NotResource': ['arn:aws:iam::123:role/a']},
+        {'Effect': 'Allow', 'NotAction': 'iam:*', 'NotResource': 'arn:aws:s3:::a'},
+    ],
+)
+async def test_inline_policy_rejects_not_action_not_resource(tool_name, stmt):
+    """NotAction/NotResource are inverse matches and must be treated as broad.
+
+    Inspecting only Action/Resource let statements such as NotAction 'iam:*' with
+    Resource '*' (every non-IAM action, account-wide) or Action '*' with a NotResource
+    (every action on everything but one resource) bypass the guard.
+    """
+    from awslabs.iam_mcp_server import server
+
+    Context.initialize(readonly=False, require_confirmation=False)
+    target = 'role_name' if tool_name == 'put_role_policy' else 'user_name'
+
+    with patch('awslabs.iam_mcp_server.server.get_iam_client') as mock_get_client:
+        mock_client = Mock()
+        mock_get_client.return_value = mock_client
+
+        with pytest.raises(IamValidationError) as exc_info:
+            await getattr(server, tool_name)(
+                **{target: 'test-principal'},
+                policy_name='bad-policy',
+                policy_document={'Version': '2012-10-17', 'Statement': [stmt]},
+                confirmed=True,
+            )
+        assert 'overly broad Action' in str(exc_info.value)
+        getattr(mock_client, tool_name).assert_not_called()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    'stmt',
+    [
+        {'Effect': 'Allow', 'NotAction': 's3:DeleteObject', 'Resource': 'arn:aws:s3:::b/*'},
+        {'Effect': 'Allow', 'Action': 's3:GetObject', 'NotResource': 'arn:aws:s3:::secret/*'},
+        {'Effect': 'Deny', 'NotAction': 'iam:*', 'Resource': '*'},
+        {'Effect': 'Deny', 'Action': '*', 'NotResource': 'arn:aws:s3:::a'},
+    ],
+)
+async def test_inline_policy_allows_scoped_not_action_not_resource(stmt):
+    """NotAction/NotResource are allowed when the other half is scoped, or in Deny statements."""
+    from awslabs.iam_mcp_server.server import put_user_policy
+
+    Context.initialize(readonly=False, require_confirmation=False)
+
+    with patch('awslabs.iam_mcp_server.server.get_iam_client') as mock_get_client:
+        mock_get_client.return_value = Mock()
+
+        result = await put_user_policy(
+            user_name='test-user',
+            policy_name='scoped-policy',
+            policy_document={'Version': '2012-10-17', 'Statement': [stmt]},
+            confirmed=True,
+        )
+        assert 'Successfully' in result.message
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize('tool_name', ['put_user_policy', 'put_role_policy'])
+@pytest.mark.parametrize(
+    'stmt',
+    [
+        # Exact reproduction from the report.
+        {
+            'Effect': 'Allow',
+            'Action': ['iam:CreateAccessKey', 'iam:AttachUserPolicy', 'iam:PutUserPolicy'],
+            'Resource': '*',
+        },
+        {'Effect': 'Allow', 'Action': 'iam:PutRolePolicy', 'Resource': '*'},
+        {'Effect': 'Allow', 'Action': 'iam:AddUserToGroup', 'Resource': '*'},
+        {'Effect': 'Allow', 'Action': 'iam:CreateLoginProfile', 'Resource': '*'},
+        {'Effect': 'Allow', 'Action': 'iam:PassRole', 'Resource': '*'},
+        # IAM action names are case-insensitive.
+        {'Effect': 'Allow', 'Action': 'IAM:createAccessKey', 'Resource': '*'},
+        # Partial wildcards that expand to escalation actions.
+        {'Effect': 'Allow', 'Action': 'iam:Put*', 'Resource': '*'},
+        {'Effect': 'Allow', 'Action': 'iam:*Policy', 'Resource': 'arn:aws:iam::*:*'},
+        {'Effect': 'Allow', 'Action': 'iam:Create?ccessKey', 'Resource': '*'},
+        # Mixed with benign actions/resources in the same statement.
+        {
+            'Effect': 'Allow',
+            'Action': ['s3:GetObject', 'iam:CreatePolicyVersion'],
+            'Resource': ['arn:aws:s3:::bucket/*', '*'],
+        },
+        # Every principal of a type is as broad as '*' for escalation.
+        {
+            'Effect': 'Allow',
+            'Action': 'iam:CreateAccessKey',
+            'Resource': 'arn:aws:iam::123456789012:user/*',
+        },
+        {'Effect': 'Allow', 'Action': 'iam:*', 'Resource': 'arn:aws-us-gov:iam::*:role/*'},
+        {'Effect': 'Allow', 'Action': '*', 'Resource': 'arn:aws:iam::123456789012:role/*'},
+        # NotAction that doesn't exclude the escalation actions, on every role.
+        {'Effect': 'Allow', 'NotAction': 's3:*', 'Resource': 'arn:aws:iam::123:role/*'},
+        {
+            'Effect': 'Allow',
+            'NotAction': ['s3:*', 'iam:CreateAccessKey'],
+            'Resource': 'arn:aws:iam::123:role/*',
+        },
+        # Escalation action with NotResource.
+        {'Effect': 'Allow', 'Action': 'iam:UpdateAssumeRolePolicy', 'NotResource': 'x'},
+    ],
+)
+async def test_inline_policy_rejects_privilege_escalation_actions(tool_name, stmt):
+    """Named IAM privesc actions on a broad Resource are equivalent to 'iam:*'.
+
+    Recognizing only '*' and 'service:*' let canonical escalation actions such as
+    iam:CreateAccessKey or iam:AttachUserPolicy with Resource '*' bypass the guard.
+    """
+    from awslabs.iam_mcp_server import server
+
+    Context.initialize(readonly=False, require_confirmation=False)
+    target = 'role_name' if tool_name == 'put_role_policy' else 'user_name'
+
+    with patch('awslabs.iam_mcp_server.server.get_iam_client') as mock_get_client:
+        mock_client = Mock()
+        mock_get_client.return_value = mock_client
+
+        with pytest.raises(IamValidationError) as exc_info:
+            await getattr(server, tool_name)(
+                **{target: 'test-principal'},
+                policy_name='bad-policy',
+                policy_document={'Version': '2012-10-17', 'Statement': [stmt]},
+                confirmed=True,
+            )
+        assert 'privilege-escalation' in str(exc_info.value)
+        getattr(mock_client, tool_name).assert_not_called()
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    'stmt',
+    [
+        # Self-service credential management scoped to the caller.
+        {
+            'Effect': 'Allow',
+            'Action': ['iam:CreateAccessKey', 'iam:UpdateLoginProfile'],
+            'Resource': 'arn:aws:iam::123456789012:user/${aws:username}',
+        },
+        {
+            'Effect': 'Allow',
+            'Action': 'iam:PassRole',
+            'Resource': 'arn:aws:iam::123456789012:role/my-lambda-role',
+        },
+        # Path-scoped, not every role in the account.
+        {
+            'Effect': 'Allow',
+            'Action': 'iam:AttachRolePolicy',
+            'Resource': 'arn:aws:iam::123456789012:role/app/*',
+        },
+        # Read-only IAM wildcards don't expand to any escalation action.
+        {'Effect': 'Allow', 'Action': ['iam:Get*', 'iam:List*'], 'Resource': '*'},
+        # NotAction excluding all of IAM, on role ARNs, grants nothing that escalates.
+        {'Effect': 'Allow', 'NotAction': 'iam:*', 'Resource': 'arn:aws:iam::123:role/*'},
+        {
+            'Effect': 'Allow',
+            'NotAction': ['iam:*', 'sts:*'],
+            'Resource': 'arn:aws:iam::123:role/*',
+        },
+        {'Effect': 'Deny', 'Action': 'iam:CreateAccessKey', 'Resource': '*'},
+    ],
+)
+async def test_inline_policy_allows_scoped_privilege_escalation_actions(stmt):
+    """Escalation actions on specific principals, and read-only IAM access, are allowed."""
+    from awslabs.iam_mcp_server.server import put_user_policy
+
+    Context.initialize(readonly=False, require_confirmation=False)
+
+    with patch('awslabs.iam_mcp_server.server.get_iam_client') as mock_get_client:
+        mock_get_client.return_value = Mock()
+
+        result = await put_user_policy(
+            user_name='test-user',
+            policy_name='scoped-policy',
+            policy_document={'Version': '2012-10-17', 'Statement': [stmt]},
+            confirmed=True,
+        )
+        assert 'Successfully' in result.message
+
+
 @pytest.mark.asyncio
 async def test_put_user_policy_rejects_wildcard():
     """Test that put_user_policy rejects Action:* with Resource:*."""