least-privilege

An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. — Permify is now part of FusionAuth 🎉

Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy

Rapid7 | insightCloudSec | Kubernetes RBAC Power Toys - Visualize, Analyze, Generate & Query

Create a break glass role for emergency use in order to limit AWS production account access. Configure automatic alerts and logging of activities in the role to secure its use in production environments.

Repository for iamfast questions and issues

🔐 Lightning fast, global scale authorization service without the overhead of a yet another DSL.

Validate all your Customer IAM Policies against AWS Access Analyzer - Policy Validation

Lambda Extension for iamlive

Cloud governance reports from native services in a clear and readable digest

TOTP MFA for teams: Shamir's Secret Sharing and zero trust OTP generation

Catalog and understand risks from granting IAM privileges

plan-bound authorization architecture for governing privileged effects in untrusted computational agents.

NHInsight — Open-source security tool to find risky non-human identities, tokens, and CI/CD access paths across AWS, Azure, GCP, GitHub, Kubernetes, and GitHub Actions.

command line interface for Permify

Python CLI for detecting cloud storage misconfigurations. AWS S3 real API scanning with boto3. Azure Blob and GCP Storage on roadmap.

Python tool to audit IAM users, access keys, MFA status, and root accounts across AWS Organizations multi-account environments. Generates an interactive HTML dashboard. Runs locally via Docker or on a schedule via ECS Fargate with Slack notifications.

📚 ☁️ For Architects and Engineers ☁️ 📚

A POSIX-isolated agent host: a Go daemon that runs an AI agent harness on behalf of the person who asked, executes every tool call as that person's own unprivileged Linux user, holds side-effecting calls at an approval gate, and writes every step to a durable event ledger.

Read-only analysis of effective NTFS, AD, and SMB permissions with an explainable permission path. Rust, Windows.

This project shows a complete use case with the least privilege principle on Google Cloud using modular Terraform, Terragrunt and Cloud Build