Amphi is a free collection of open-source tools for building, testing, understanding, converting, and managing cloud IAM policies.
Cloud access should not run on guesswork. Amphi helps security engineers and developers reason about what IAM policies actually mean, test access decisions before changes reach production, and understand effective access across real cloud environments.
IAM Expand
See what wildcard actions actually grant by expanding patterns into the individual AWS actions behind them.
Open in Amphi
IAM Shrink
Compress IAM action lists to reduce policy size without changing the permissions they represent.
Open in Amphi
IAM Convert
Translate IAM policies between JSON and infrastructure-as-code formats.
Open in Amphi
IAM Truth
Read policy conditions as truth tables so you can see which inputs produce an Allow or Deny.
Open in Amphi
IAM Test
Build tests for IAM policy behavior and validate authorization logic before deploying it.
Open in Amphi
IAM Simulate
Evaluate AWS authorization decisions locally, including the interaction between policies and IAM policy types.
Open in Amphi
IAM Collect
Collect policies, identities, resources, and other authorization data from AWS environments into a dataset that can be analyzed locally.
See it in Amphi
IAM Lens
Explore effective access across IAM Collect data and answer questions like who can access a resource, what a principal can access, and why a request is allowed.
See it in Amphi
The tools in Amphi are backed by open-source libraries, datasets, and automation that can be used directly in your own cloud security projects.
- AWS IAM action, resource, and condition-key data: iam-data, iam-data-go, iam-data-python, iam-harvest
- IAM policy parsing and modeling: iam-policy
- IAM simulation: iam-simulate
- IAM utilities and resource matching: iam-utils
- CLI and developer libraries: cli, job, log
- Developer automation: prettier-config, dual-npm-publish-action, publishing
- In your browser: use the free hosted Amphi tools.
- In your terminal: install the CLIs and compose them into scripts.
- In your code: use the underlying libraries to build IAM-aware applications.
- In your pipelines: test policies and access changes before they reach production.
Amphi is built in the open. If you find a bug, have an idea, or run into an IAM edge case we should support, open an issue or send a pull request in the relevant repository.
Cloud IAM has more than enough weird edge cases to go around.