aws-iam-ref

A Python library and CLI tool for accessing AWS IAM actions, resources, and condition keys reference data.

Features

• 🔍 Search IAM actions by name, service, or access level
• 🏷️ Filter by tag support (RequestTag, ResourceTag, TagKeys)
• 🔗 Identify dependent actions required for each operation
• 📊 Reference 20,000+ IAM actions from 441 AWS services
• 🚀 Fast local CLI with no AWS credentials required
• 🐍 Python API for programmatic access

Installation

pip install aws-iam-ref

CLI Usage

Search for actions

# Search for S3 actions
ref search s3

# Search for specific action
ref search iam:CreateRole

# Find actions with RequestTag support
ref search --tag request

# Find actions with dependent actions
ref search --dependent

# Filter by service and access level
ref search --service ec2 --access-level Write

# Show all actions (paginated)
ref search --limit 100

Show action details

ref show iam:CreateRole

Output:

iam:CreateRole
============================================================
Description:     Grants permission to create a new role
Access Level:    Write

Tag Support:
  RequestTag:    Yes
  ResourceTag:   No
  TagKeys:       Yes

Resource-Level Permissions: Yes

Resources (1):
  - role*

Condition Keys (3):
  - iam:PermissionsBoundary
  - aws:TagKeys
  - aws:RequestTag/${TagKey}

Dependent Actions (0):

List all services

ref services

Show statistics

ref stats

Output:

AWS IAM Reference Statistics
==================================================
Total Services:        441
Total Actions:         20,256
With RequestTag:       2,143
With ResourceTag:      1,891
Dependent Action Relations: 625
Last Updated:          2026-02-02 10:30:00

Update data

ref-update

This scrapes the latest data from AWS documentation (takes 5-10 minutes).

Python API

from ref import IAMReference

# Initialize
ref = IAMReference()

# Search actions
actions = ref.search_actions(
    query="s3:Get",
    has_request_tag=True
)

for item in actions:
    service = item['service']
    action = item['action']
    print(f"{service['service']}:{action['name']}")
    print(f"  Description: {action.get('description')}")
    print(f"  Access Level: {action['accessLevel']}")
    print(f"  Has RequestTag: {action['hasRequestTag']}")

# Get specific action
result = ref.get_action('iam', 'CreateRole')
if result:
    print(result['action']['conditionKeys'])

# Get statistics
stats = ref.get_stats()
print(f"Total actions: {stats['total_actions']}")

Data Source

Data is scraped from the AWS Service Authorization Reference documentation.

Requirements

• Python 3.7+
• requests
• beautifulsoup4

License

MIT License - see LICENSE file for details.

Contributing

Contributions welcome! Please open an issue or pull request on GitHub.

Related Projects

• AWS IAM Actions Web Reference - Web interface for the same data