Policy Sentry

No entries match these filters. Clear filters

1. 0.16.0 Apr 14, 2026 · release notes

   Policy Sentry 0.16.0 adds Deny effect support and tightens dependent-action resource scoping in generated IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.16.0 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.16.0

   • Supports Deny effect in generated IAM policies, enabling least-privilege deny statements alongside allow rules.
   • Scopes dependent actions to matching resource types instead of wildcard, producing tighter least-privilege policies automatically.
   • Updates the IAM actions database with the latest AWS service definitions.

   3 details in Everything

2. 0.15.1 Dec 2, 2025 · release notes

   Policy Sentry 0.15.1 refreshes the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. actions database and drops Python 3.9 support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.15.1 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.15.1

   • Updates the bundled IAM actions database with the latest AWS service catalog data.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported; upgrading requires Python 3.10 or later.
3. 0.14.0 Jan 1, 2025 · release notes

   policy_sentry 0.14.0 updates the IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. database and expands wildcard querying of the action table.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.14.0 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.14.0

   └──▷ TRY IT
   Query all actions across every service using the wildcard to quickly audit the full action table.
   copy

   $ policy_sentry query action-table --service '*'

   • Updates the bundled IAM actions database to reflect the latest AWS service changes.
   • Expands the capability of * wildcard querying against the action table, enabling broader action lookups.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.8 is no longer supported; upgrading requires Python 3.9 or later.
4. 0.13.0 Jul 21, 2024 · release notes

   Policy Sentry 0.13.0 adds Python 3.13 support and faster IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. DB loading.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.13.0 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.13.0

   • Supports Python 3.13.
   • Improves IAM DB loading performance.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.7 is no longer supported; upgrade to Python 3.8+ before upgrading.
   • !Path constants changed from str to Path type, which may break code or configs that pass these constants as strings.
   • !Deprecated code has been removed; any usage of previously deprecated APIs will break.
   • !AWS docs removed from the wheel and JSON minified; tooling that relied on bundled AWS docs or unminified JSON files will break.
5. 0.12.14 Jul 8, 2024 · release notes

   Adds query CLI subcommand for retrieving IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. service data directly from Policy Sentry

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.12.14 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.12.14

6. 0.11.14 Jul 16, 2021 · release notes

   Policy Sentry 0.11.14 adds multiple policy output via Terraform module

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.14 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.11.14

   • terraform module now supports generating multiple IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies in a single folder

   1 detail in Everything

7. 0.11.12 Jul 16, 2021 · release notes

   Adds ability to create multiple IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies in a single folder via the Terraform module

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.12 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.11.12

8. 0.11.11 Jul 16, 2021 · release notes

   Policy Sentry 0.11.11 enables creating multiple policies in the same folder via Terraform module

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.11 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.11.11

   • Adds support for creating multiple policies in the same folder using the Terraform module
   • Updates database via GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.

   2 details in Everything

9. 0.11.3 Dec 28, 2020 · release notes

   Policy Sentry 0.11.3 adds a method to retrieve links for all AWS Actions

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 0.11.3 https://github.com/salesforce/policy_sentry.git
   # already have the repo? check out this version:
   $ git checkout 0.11.3

   └──▷ USE IT
   Programmatically discover the official documentation for any AWS service action without manual lookup.
   python copy

   from policy_sentry.shared.read_policy import PolicySentryReadPolicy
   
   p = PolicySentryReadPolicy("policy.yaml")
   links = p.get_all_actions_links()
   print(links["s3:ListBucket"])

10. 0.11.2 Dec 22, 2020 · release notes

    Policy Sentry 0.11.2 adds IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. action hyperlinks and abbreviated CLI flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.11.2 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.11.2

    • Adds the get_api_documentation_link_for_action query to retrieve hyperlinked AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Action metadata

    1 detail in Everything

11. 0.11.0 Nov 18, 2020 · release notes

    Policy Sentry 0.11.0 adds Terraform parsing support for skip_resource_constraints, exclude_actions, and AWS paths

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.11.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.11.0

    • Adds skip_resource_constraints and exclude_actions configuration keys to the Terraform module config file to control which resources are analyzed

    1 detail in Everything

12. v0.10.0 Nov 4, 2020 · release notes

    Policy Sentry v0.10.0 adds configurable --minimize flag and --minimize-length argument to control output policy size

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.10.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout v0.10.0

    • Adds --minimize boolean flag and --minimize-length <value> argument to the policy-sentry minimize command to optionally limit the length of generated IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies
    • Updates the underlying IAM permission database for coverage of new AWS services and changes

    2 details in Everything

13. 0.9.1 Oct 27, 2020 · release notes

    Adds --resource-type flag to policy_sentry query and improves write-policy minimization grouping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.1 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.9.1

    └──▷ USE IT
    Filter query results to only actions associated with a specific resource type.
    shell copy

    policy_sentry query action-table --resource-type s3

    • --resource-type flag added to policy_sentry query action-table command
    • Minimization is improved by grouping results based on ARNs for write-policy

    2 details in Everything

14. 0.9.0 Oct 1, 2020 · release notes

    Policy Sentry 0.9.0 adds YAML output format support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.9.0

    └──▷ TRY IT
    Generate an IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy in YAML format for easier human review or CI/CD pipeline consumption.
    copy

    $ policy-sentry write-policy --fmt yaml

    • write-policy now supports the --fmt yaml flag to output IAM policies in YAML format

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The raw IAM definition structure changed from a list to a dictionary, breaking scripts that relied on the previous list indexing behavior
    • !The IAM definition object now includes a required key, which may affect parsers expecting only existing keys
15. 0.7.2.1 Mar 23, 2020 · release notes

    Policy Sentry 0.7.2.1 adds all input support for wildcard ARN actions across all AWS services

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.2.1 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.7.2.1

    └──▷ USE IT
    Retrieve all actions supporting wildcard ARNs across every AWS service without listing them individually.
    python copy

    get_actions_that_support_wildcard_arns_only(service="all")

    • get_actions_that_support_wildcard_arns_only and get_actions_at_access_level_that_support_wildcard_arns_only now accept all as the service parameter to scan every AWS service prefix.

    1 detail in Everything

16. 0.7.1 Feb 19, 2020 · release notes

    Policy Sentry 0.7.1 adds UpperCamelCase output, new template structure for wildcard actions, and a Terraform module

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.1 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.7.1

    • Modifies the template structure to allow easy additions of wildcard-only actions with access levels specific to services.
    • Changes default output casing to UpperCamelCase for human readability; --minimize flag on write-policy retains lowercase.

    2 details in Everything

17. 0.7.0 Feb 7, 2020 · release notes

    Policy Sentry 0.7.0 drops analyze/download-policies, introduces SidGroup for conditions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    • initialize command is now optional, allowing the CLI to run without pre-initialized database files.
    • Library now uses SidGroup instead of ArnActionGroup, enabling condition key support in IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies.
    • The write-policy method interface has been refactored for easier programmatic usage.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The analyze command is removed; users must migrate to Parliament for analysis functionality.
    • !The download-policies command is removed from the CLI.
    • !Template format has changed significantly; existing templates require manual migration or pinning to a previous version.
    • !The --crud flag for the write-policy command is removed; Policy Sentry now auto-detects the format.
18. 0.6.11 Jan 28, 2020 · release notes

    Policy Sentry v0.6.11 makes initialize instant; adds --build and --fetch flags for manual DB management.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.11 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.11

    └──▷ TRY IT
    Rebuild the policy database from local files.
    copy

    $ policy_sentry initialize --build

    Download and build using the latest AWS documentation.
    copy

    $ policy_sentry initialize --fetch

    • initialize command now completes instantly by default
    • Adds --build flag to initialize to manually rebuild the database
    • Adds --fetch flag to initialize to build using latest AWS docs

    3 details in Everything

19. 0.6.9 Jan 24, 2020 · release notes

    Policy Sentry 0.6.9 adds wildcard-only action queries and YAML output to the query command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.9 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.9

    └──▷ USE IT
    Find actions that are exclusively wildcard-only (e.g., s3:PutAccountPublicAccessBlock) for S3 at a specific access level.
    shell copy

    policy_sentry query --action-service s3 --access-levels PermissionsManagement

    Export query results in YAML format for use in pipelines or documentation.
    shell copy

    policy_sentry query --output-type yaml

    • Adds support for querying query command for wildcard-only actions at an access level per service

    1 detail in Everything

20. 0.6.7 Jan 9, 2020 · release notes

    Policy Sentry 0.6.7 exposes template generation functions and allows arn/tag naming in IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. templates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.7 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.7

    └──▷ USE IT
    Programmatically generate an IAM policy template using the new Python API functions.
    python copy

    from policy_sentry.querying.crud import get_crud_template_dict
    
    template = get_crud_template_dict()
    print(template['role_arn'])

    Update an existing YAML template to use the new tagging key instead of tag.
    yaml copy

    role_arn: arn:aws:iam::123456789012:role/my-role
    tagging:
      - Key: Environment
        Value: Prod

    • get_crud_template_dict and get_actions_template_dict are now available to generate IAM policy templates programmatically.
    • write_policy_with_actions and write_policy_with_access_levels can be called directly as entry points.
    • IAM templates now use role_arn and tagging keys instead of the previous arn and tag naming conventions.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Templates previously using arn or tag keys must be updated to use role_arn and tagging respectively.
21. 0.6.4 Jan 3, 2020 · release notes

    Policy Sentry 0.6.4 adds connect_db('bundled') for python package usage without html docs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.4 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.4

    └──▷ USE IT
    Use Policy Sentry programmatically in Python without needing external HTML dependencies
    python copy

    from policy_sentry.database.connection import connect_db
    db_session = connect_db('bundled')

    • Adds support for Python package usage via db_session = connect_db('bundled') which eliminates the need to build the database from HTML docs
    • Moves internal code to a saner subfolder structure

    2 details in Everything

22. 0.6.2 Dec 17, 2019 · release notes

    Adds --fetch argument to policy_sentry initialize command for automatic policy fetching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.2 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.2

    └──▷ TRY IT
    Initialize the local policy database with the latest IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. service definitions automatically, avoiding manual updates.
    copy

    $ policy_sentry initialize --fetch

    • Adds --fetch argument to policy_sentry initialize command to fetch latest IAM policies automatically during initialization
    • Adds overrides-resource-policies.yml to specifically identify API calls that modify resource based policies

    2 details in Everything

23. 0.6.0 Nov 27, 2019 · release notes

    Policy Sentry 0.6.0 adds recursive policy analysis, multi-format reports and configurable filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds --recursive support to the download-policies command for bulk IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policy retrieval across multiple AWS accounts.
    • Enables the new analyze subcommand (renamed from analyze-iam-policy) which outputs comprehensive reports in CSV, raw JSON, and optional Markdown formats.
    • Introduces custom report configuration and role exclusion filtering in the analyze functionality to reduce false positives across multiple risk categories.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The analysis output folder has moved from ~/.policy_sentry/policy-analysis to ~/.policy_sentry/analysis.
    • !The CLI subcommand analyze-iam-policy is renamed to analyze.
24. 0.5.5 Nov 21, 2019 · release notes

    Policy Sentry 0.5.5 adds a credentials-exposure.txt audit file to the analyze command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.5 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.5.5

25. 0.5.4 Nov 21, 2019 · release notes

    Adds direct IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. database query subcommands via CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.4 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.5.4

    • Adds policy_sentry query action-table command to query the IAM database directly.
    • Adds policy_sentry query arn-table command to query the IAM database directly.
    • Adds policy_sentry query condition-table command to query the IAM database directly.
    • Policy writing CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. mode now supports actions that cannot restrict according to specific ARNs, like s3:CreateBucket, or secretsmanager:CreateSecret

    4 details in Everything

26. 0.5.1 Oct 18, 2019 · release notes

    Policy Sentry 0.5.1 adds support for Deepracer, Signer, and EventBridgeEventBridgeAWS's managed event bus service that routes events between cloud services, SaaS apps, and custom code using rules and targets, letting tools react to state changes without polling or managing message infrastructure. services.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.1 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.5.1

    └──▷ USE IT
    Generate IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies for AWS DeepRacer, Signer, or EventBridge actions that were previously unsupported.
    shell copy

    policy_sentry write-policy --access-levels write --service deepracer

    Write policies covering AWS Signer actions to enable code-signing workflows.
    shell copy

    policy_sentry write-policy --actions signer:signJob --file policy.json

27. 0.5.0 Oct 18, 2019 · release notes

    Adds custom YML support to initialize command and new data file for overriding AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Access Levels.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.0 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.5.0

    └──▷ TRY IT
    Apply local access level overrides instead of relying solely on upstream AWS documentation by passing a custom YAML file during initialization.
    copy

    $ policy_sentry initialize --yaml-file ./my-custom-overrides.yml

    • initialize command now accepts a custom YML file argument to provide user-defined access level overrides
    • Added policy_sentry/shared/data/access-level-overrides.yml containing preloaded AWS IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. access level override rules

    2 details in Everything

28. 0.4.5 Oct 17, 2019 · release notes

    Adds download-policies CLI command to fetch AWS managed and customer-managed IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies locally.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.5 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.4.5

    └──▷ USE IT
    Download current AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. policies to local cache for offline analysis
    shell copy

    policy_sentry download-policies

    • New download-policies subcommand that downloads AWS managed and customer-managed IAM policies to ~/.policy_sentry/account-id/aws-managed or ~/.policy_sentry/account-id/customer-managed
    • Supports YML files with missing access level blocks (e.g., excluding Tagging or Permissions Management)

    2 details in Everything

29. 0.4.3 Oct 15, 2019 · release notes

    Policy Sentry 0.4.3 adds download-policies command and directory support to analyze-iam-policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.3 https://github.com/salesforce/policy_sentry.git
    # already have the repo? check out this version:
    $ git checkout 0.4.3

    └──▷ TRY IT
    Fetch the latest AWS managed IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies for a specific account to use in your local analysis workspace.
    copy

    $ policy_sentry command download-policies --account-id <ACCOUNT_ID>

    Analyze all IAM policy files contained within a specific directory.
    copy

    $ policy_sentry command analyze-iam-policies <DIRECTORY_PATH>

    • Adds download-policies subcommand to download AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. managed and customer-managed policies directly into the local configuration directory (~/.policy_sentry/account-id/...).
    • analyze-iam-policies now accepts a directory argument, allowing analysis of multiple policy files at once.
    • Adds preloaded audit files that are automatically copied during setup.

    3 details in Everything