IAM Floyd

AWS IAM policy statement generator with a fluent interface, for TypeScript, JavaScript, Python, Java, C# and Go.

IAM Floyd has a class for every AWS service, with a method for every action, resource type and condition key. Your IDE completes them and shows their documentation, so you neither look up action names and ARN formats, nor deploy policies with typos.

import { Statement } from 'iam-floyd';

const statement = new Statement.Ec2()
  .allow()
  .toStartInstances()
  .toStopInstances()
  .ifResourceTag('Owner', '${aws:username}');

{
  "Condition": {
    "StringLike": {
      "ec2:ResourceTag/Owner": "${aws:username}"
    }
  },
  "Action": ["ec2:StartInstances", "ec2:StopInstances"],
  "Resource": "*",
  "Effect": "Allow"
}

Python

from iam_floyd import Statement

statement = (
    Statement.Ec2()
        .allow()
        .to_start_instances()
        .to_stop_instances()
        .if_resource_tag('Owner', '${aws:username}')
)

Java

import com.udondan.iamFloyd.statement.Ec2;

Ec2 statement = new Ec2()
    .allow()
    .toStartInstances()
    .toStopInstances()
    .ifResourceTag("Owner", "${aws:username}");

using Statement = IAM.Floyd.Statement;

var statement = new Statement.Ec2()
    .Allow()
    .ToStartInstances()
    .ToStopInstances()
    .IfResourceTag("Owner", "${aws:username}");

import (
	"udondan.github.io/iam-floyd/go/iamfloyd"
	"udondan.github.io/iam-floyd/go/iamfloyd/statement"
)

s := statement.NewEc2(nil).
	Allow().
	ToStartInstances().
	ToStopInstances().
	IfResourceTag(iamfloyd.String("Owner"), iamfloyd.String("${aws:username}"), nil)

Support for:

455 Services
22036 Actions
2329 Resource Types
2484 Condition keys

Features

Complete: generated from the AWS documentation, and updated every week
Access levels: add all actions of an access level, e.g. allReadActions() or allWriteActions()
Regular expressions: add all actions that match a pattern with allMatchingActions('/vpn/i')
Resources: build ARNs with a method per resource type, e.g. onBucket('example-bucket'), with defaults for partition, region and account
Conditions: a method per condition key, with operators like ForAnyValue:StringEquals or IfExists
AWS CDK: cdk-iam-floyd statements are an iam.PolicyStatement of the AWS CDK
Collections of common statements, and the names of all AWS managed policies
Policy converter: turn an existing JSON policy into IAM Floyd code with the online converter

Packages

IAM Floyd comes in two variants, with the same API and the same version number in every language:

iam-floyd creates statements as JSON, for the AWS SDKs, CloudFormation, Terraform or anything else that takes an IAM policy. The packages have no dependencies. In Python, Java, C# and Go, they are native and do not need Node.js.
cdk-iam-floyd creates statements of the AWS CDK v2. In Python, Java, C# and Go, they are built with jsii, like the AWS CDK itself, and need Node.js.

Language	`iam-floyd`	`cdk-iam-floyd`
TypeScript / JavaScript
Python
Java
C# / .NET
Go

Installation

# TypeScript / JavaScript
npm install iam-floyd           # or cdk-iam-floyd

# Python
pip install iam-floyd           # or cdk-iam-floyd

# Java (Maven), with the version of the release
#   com.udondan:iam-floyd       # or com.udondan:cdk-iam-floyd

# C# / .NET
dotnet add package IAM.Floyd    # or CDK.IAM.Floyd

# Go
go get udondan.github.io/iam-floyd/go/iamfloyd   # or .../go/cdkiamfloyd

IAM Floyd has not reached 1.0.0 yet, and the API can still change between releases. Pin the exact version.

The requirements of each package and the compatibility with the AWS CDK are listed in the documentation.

Documentation

The documentation explains all features, with examples in every language.

Legal

The service models in the lib/generated/model folder, and the code generated from them, are derived from the AWS documentation. The class- and function-names and their description therefore are property of AWS.

AWS and their services are trademarks, registered trademarks or trade dress of AWS in the U.S. and/or other countries.

This project is not affiliated, funded, or in any way associated with AWS.

IAM Floyd is licensed under Apache License 2.0. Dependencies might be released under different licenses.

Metadata

Release files for cdk-iam-floyd 0.849.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for cdk-iam-floyd 0.849.0
File	Size	Uploaded
cdk_iam_floyd-0.849.0.tar.gz	8.5 MB	Oct 4, 2026	Details

Built distribution (wheel)

Table of built distributions (wheels) for cdk-iam-floyd 0.849.0
File	Interpreter	ABI	Platform	Reset
cdk_iam_floyd-0.849.0-py3-none-any.whl 8.6 MB Oct 4, 2026	Python 3	none	any	Details

Total release size: 17.1 MB

Release files / cdk_iam_floyd-0.849.0.tar.gz

Download URL	cdk_iam_floyd-0.849.0.tar.gz
Size	8.5 MB
Tags	Source
SHA-256 checksum How to use checksums	`b44d88ecb68c31fc9af8d28f822cfb5f116e6611cea086650f78604c6924e5fd`
BLAKE2b-256 checksum How to use checksums	`aa12862982c731627ef50323a6425037623140672c51e972ee54a805fe48c821`
Upload date	Oct 4, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/udondan/iam-floyd
Publishing commit: github.com/udondan/iam-floyd/tree/04e6491b85fa7f6daecd59b4d98ffb1729b47c06

Workflow

Publishing configuration: github.com/udondan/iam-floyd/blob/04e6491b85fa7f6daecd59b4d98ffb1729b47c06/.github/workflows/test-and-publish.yml
Publishing logs: github.com/udondan/iam-floyd/actions/runs/37239260372/attempts/1

Artifact

Subject: cdk_iam_floyd-0.849.0.tar.gz
SHA-256 checksum: b44d88ecb68c31fc9af8d28f822cfb5f116e6611cea086650f78604c6924e5fd Verifying attestations

Release files / cdk_iam_floyd-0.849.0-py3-none-any.whl

Download URL	cdk_iam_floyd-0.849.0-py3-none-any.whl
Size	8.6 MB
Tags	Python 3
SHA-256 checksum How to use checksums	`72e287a0047c9e37693009b3d63ebb709a9ea994ba4bca16f2a7b25c131d03a2`
BLAKE2b-256 checksum How to use checksums	`bc0080a52ac8ddbe4ba298edee374f8010b3df5f32b3c62f920637ac69795c4d`
Upload date	Oct 4, 2026
Uploaded using Trusted Publishing? What is trusted publishing?	Yes
Uploaded via	`twine/7.0.0 CPython/3.13.14`

Provenance

Identity

Publishing platform: GitHub Actions
Publishing repository: github.com/udondan/iam-floyd
Publishing commit: github.com/udondan/iam-floyd/tree/04e6491b85fa7f6daecd59b4d98ffb1729b47c06

Workflow

Publishing configuration: github.com/udondan/iam-floyd/blob/04e6491b85fa7f6daecd59b4d98ffb1729b47c06/.github/workflows/test-and-publish.yml
Publishing logs: github.com/udondan/iam-floyd/actions/runs/37239260372/attempts/1

Artifact

Subject: cdk_iam_floyd-0.849.0-py3-none-any.whl
SHA-256 checksum: 72e287a0047c9e37693009b3d63ebb709a9ea994ba4bca16f2a7b25c131d03a2 Verifying attestations