infrawise 0.12.6 → 0.13.0

package/README.md

@@ -151,7 +151,7 @@ Add to your editor's MCP config:
 | ---------------------------- | ----------------------------------------------------------------------------------------------------------- |
 | `get_infra_overview`         | Complete snapshot — all services, counts, high-severity findings, and a `configured` flag                   |
 | `get_graph_summary`          | Full infrastructure graph — all nodes, edges, and findings                                                  |
-| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes                           |
+| `analyze_function`           | Issues in a specific function — scans, missing indexes, N+1, trigger event shapes, missing IAM permissions  |
 | `suggest_gsi`                | Exact GSI config for a DynamoDB table + attribute                                                           |
 | `postgres_index_suggestions` | Exact `CREATE INDEX` SQL for your actual table                                                              |
 | `suggest_mongo_index`        | Exact `createIndex` command for a MongoDB collection + field                                                |
@@ -161,7 +161,7 @@ Add to your editor's MCP config:
 | `get_topic_details`          | SNS topics — subscription counts, protocols, and filter policies (required message attributes per subscription) |
 | `get_secrets_overview`       | Secrets Manager — names and rotation status (values never included)                                         |
 | `get_parameter_overview`     | SSM Parameter Store — names, types, tiers (values never included)                                           |
-| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
+| `get_lambda_overview`        | Lambda functions — runtime, memory, timeout, execution role ARN, triggers (SQS/SNS/DynamoDB/Kinesis/MSK/EventBridge/S3), env var key names |
 | `get_eventbridge_details`    | EventBridge rules — name, state, schedule/event pattern, target functions                                   |
 | `get_s3_overview`            | S3 buckets — versioning, encryption, public access, event notifications                                     |
 | `get_log_errors`             | CloudWatch error patterns and counts (no raw log messages)                                                  |

package/dist/adapters/aws/services.js

@@ -7,6 +7,7 @@ import { SecretsManagerClient, ListSecretsCommand } from '@aws-sdk/client-secret
 import { LambdaClient, ListFunctionsCommand, ListEventSourceMappingsCommand, } from '@aws-sdk/client-lambda';
 import { EventBridgeClient, ListRulesCommand, ListTargetsByRuleCommand, } from '@aws-sdk/client-eventbridge';
 import { RDSClient, DescribeDBInstancesCommand } from '@aws-sdk/client-rds';
+import { IAMClient, ListAttachedRolePoliciesCommand, GetPolicyCommand, GetPolicyVersionCommand, ListRolePoliciesCommand, GetRolePolicyCommand, } from '@aws-sdk/client-iam';
 import { fromIni } from '@aws-sdk/credential-providers';
 import { logger } from '../../core/index.js';
 function clientConfig(cfg) {
@@ -209,6 +210,77 @@ export async function extractSecretsMetadata(cfg = {}) {
 export async function validateSecretsAccess(cfg = {}) {
     await new SecretsManagerClient(clientConfig(cfg)).send(new ListSecretsCommand({ MaxResults: 1 }));
 }
+function servicesFromDoc(doc) {
+    const out = new Set();
+    for (const stmt of doc.Statement ?? []) {
+        if (stmt.Effect !== 'Allow')
+            continue;
+        const actions = Array.isArray(stmt.Action) ? stmt.Action : stmt.Action ? [stmt.Action] : [];
+        for (const a of actions) {
+            if (a === '*') {
+                out.add('*');
+                continue;
+            }
+            const prefix = a.split(':')[0].toLowerCase();
+            if (prefix)
+                out.add(prefix);
+        }
+    }
+    return [...out];
+}
+async function extractAllowedServices(roleArn, cfg) {
+    const client = new IAMClient(clientConfig(cfg));
+    const roleName = roleArn.split('/').pop();
+    const services = new Set();
+    try {
+        let marker;
+        do {
+            const res = await client.send(new ListAttachedRolePoliciesCommand({ RoleName: roleName, Marker: marker }));
+            for (const policy of res.AttachedPolicies ?? []) {
+                try {
+                    const meta = await client.send(new GetPolicyCommand({ PolicyArn: policy.PolicyArn }));
+                    const versionId = meta.Policy?.DefaultVersionId;
+                    if (!versionId)
+                        continue;
+                    const ver = await client.send(new GetPolicyVersionCommand({ PolicyArn: policy.PolicyArn, VersionId: versionId }));
+                    const doc = ver.PolicyVersion?.Document;
+                    if (doc) {
+                        const parsed = JSON.parse(decodeURIComponent(doc));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip unparseable policy */
+                }
+            }
+            marker = res.Marker;
+        } while (marker);
+        let iMarker;
+        do {
+            const res = await client.send(new ListRolePoliciesCommand({ RoleName: roleName, Marker: iMarker }));
+            for (const name of res.PolicyNames ?? []) {
+                try {
+                    const inline = await client.send(new GetRolePolicyCommand({ RoleName: roleName, PolicyName: name }));
+                    if (inline.PolicyDocument) {
+                        const parsed = JSON.parse(decodeURIComponent(inline.PolicyDocument));
+                        for (const s of servicesFromDoc(parsed))
+                            services.add(s);
+                    }
+                }
+                catch {
+                    /* skip */
+                }
+            }
+            iMarker = res.Marker;
+        } while (iMarker);
+        return [...services];
+    }
+    catch (err) {
+        logger.debug(`IAM fetch skipped for ${roleName}: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
 // ─── Lambda ───────────────────────────────────────────────────────────────────
 const EVENT_SHAPES = {
     sqs: 'event.Records[0].body',
@@ -319,6 +391,7 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
                     envVarKeys: Object.keys(fn.Environment?.Variables ?? {}),
                     layers: (fn.Layers ?? []).map((l) => l.Arn ?? '').filter(Boolean),
                     triggers: [],
+                    roleArn: fn.Role,
                 });
             }
             marker = res.NextMarker;
@@ -328,6 +401,16 @@ export async function extractLambdaMetadata(cfg = {}, includeFunctions) {
         for (const fn of functions) {
             fn.triggers = triggerMap.get(fn.arn) ?? [];
         }
+        // Batch IAM policy fetch per unique role ARN
+        const uniqueRoles = [...new Set(functions.map((f) => f.roleArn).filter(Boolean))];
+        const roleServices = new Map();
+        await Promise.all(uniqueRoles.map(async (arn) => {
+            roleServices.set(arn, await extractAllowedServices(arn, cfg));
+        }));
+        for (const fn of functions) {
+            if (fn.roleArn)
+                fn.allowedServices = roleServices.get(fn.roleArn);
+        }
     }
     catch (err) {
         logger.warn(`Lambda list failed: ${err instanceof Error ? err.message : String(err)}`);

package/dist/analyzers/aws-services.js

@@ -284,3 +284,67 @@ export class S3UnencryptedAnalyzer {
         return findings;
     }
 }
+// ─── IAM ─────────────────────────────────────────────────────────────────────
+const MINIMAL_ACTIONS = {
+    dynamodb: 'dynamodb:GetItem, dynamodb:PutItem, dynamodb:Query, dynamodb:UpdateItem, dynamodb:DeleteItem',
+    secretsmanager: 'secretsmanager:GetSecretValue',
+    ssm: 'ssm:GetParameter, ssm:GetParameters, ssm:GetParametersByPath',
+    sqs: 'sqs:SendMessage, sqs:ReceiveMessage, sqs:DeleteMessage, sqs:GetQueueAttributes',
+    sns: 'sns:Publish',
+    s3: 's3:GetObject, s3:PutObject, s3:DeleteObject',
+};
+export class LambdaMissingIAMPermissionsAnalyzer {
+    name = 'LambdaMissingIAMPermissionsAnalyzer';
+    async analyze(graph) {
+        const findings = [];
+        const nodeMap = new Map(graph.nodes.map((n) => [n.id, n]));
+        for (const lambda of graph.nodes) {
+            if (lambda.type !== 'lambda')
+                continue;
+            if (!lambda.allowedServices)
+                continue; // IAM data unavailable — skip
+            if (lambda.allowedServices.includes('*'))
+                continue; // AdministratorAccess
+            const funcNode = graph.nodes.find((n) => n.type === 'function' && n.name === lambda.name);
+            if (!funcNode)
+                continue;
+            const needed = new Set();
+            for (const edge of graph.edges) {
+                if (edge.from !== funcNode.id)
+                    continue;
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb') {
+                    needed.add('dynamodb');
+                }
+                else if (edge.type === 'reads_secret') {
+                    needed.add('secretsmanager');
+                }
+                else if (edge.type === 'reads_parameter') {
+                    needed.add('ssm');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'queue') {
+                    needed.add('sqs');
+                }
+                else if (edge.type === 'publishes_to' && target.type === 'topic') {
+                    needed.add('sns');
+                }
+            }
+            for (const service of needed) {
+                if (lambda.allowedServices.includes(service))
+                    continue;
+                findings.push({
+                    severity: 'high',
+                    issue: `Lambda "${lambda.name}" accesses ${service} but execution role has no ${service} permissions`,
+                    description: `"${lambda.name}" calls ${service} in code but its IAM execution role (${lambda.roleArn ?? 'unknown'}) has no ${service}:* permissions. This will cause AccessDeniedException at runtime — code passes tests but fails in AWS.`,
+                    recommendation: `Add ${service} permissions to the execution role for "${lambda.name}". Minimum required: ${MINIMAL_ACTIONS[service] ?? `${service}:*`}.`,
+                    metadata: { functionName: lambda.name, missingService: service, roleArn: lambda.roleArn },
+                });
+            }
+        }
+        return findings;
+    }
+}

package/dist/analyzers/index.js

@@ -5,7 +5,7 @@ export { MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer } from './mysql.j
 export { MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer } from './mongodb.js';
 export { IaCDriftAnalyzer } from './terraform.js';
 export { PipelineAnalyzer } from './pipeline.js';
-export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
+export { MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from './aws-services.js';
 export { RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, } from './rds.js';
 export async function runAllAnalyzers(graph, analyzers) {
     const allFindings = [];

package/dist/cli/commands/analyze.js

@@ -13,7 +13,7 @@ import { extractLogsMetadata } from '../../adapters/aws/logs.js';
 import { extractS3Metadata } from '../../adapters/aws/s3.js';
 import { scanRepository } from '../../context/index.js';
 import { buildGraph } from '../../graph/index.js';
-import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
+import { runAllAnalyzers, IaCDriftAnalyzer, PipelineAnalyzer, FullTableScanAnalyzer, MissingGSIAnalyzer, HotPartitionAnalyzer, MissingIndexAnalyzer, NplusOneAnalyzer, LargeSelectAnalyzer, MissingMySQLIndexAnalyzer, MySQLFullTableScanAnalyzer, MissingMongoIndexAnalyzer, MongoCollectionScanAnalyzer, MissingDLQAnalyzer, UnencryptedQueueAnalyzer, LargeQueueBacklogAnalyzer, VisibilityTimeoutMismatchAnalyzer, MissingSecretRotationAnalyzer, MissingLogRetentionAnalyzer, LambdaDefaultMemoryAnalyzer, LambdaHighTimeoutAnalyzer, LambdaMissingTriggerDLQAnalyzer, LambdaMissingIAMPermissionsAnalyzer, RDSPubliclyAccessibleAnalyzer, RDSNoBackupAnalyzer, RDSUnencryptedAnalyzer, RDSNoDeletionProtectionAnalyzer, RDSNoMultiAZAnalyzer, S3PublicAccessAnalyzer, S3MissingVersioningAnalyzer, S3UnencryptedAnalyzer, } from '../../analyzers/index.js';
 import { printFinding, printSummaryBox, log, printHeader } from '../utils.js';
 const SEVERITY_ORDER = { high: 3, medium: 2, low: 1, verify: 0 };
 function buildMarkdownReport(findings, projectName) {
@@ -100,6 +100,7 @@ function buildAnalyzers(config, iacDriftAnalyzer, iacLambdas) {
                 new LambdaDefaultMemoryAnalyzer(),
                 new LambdaHighTimeoutAnalyzer(),
                 new LambdaMissingTriggerDLQAnalyzer(),
+                new LambdaMissingIAMPermissionsAnalyzer(),
             ]
             : []),
         ...(config.rds?.enabled === true

package/dist/graph/index.js

@@ -148,6 +148,8 @@ export function buildGraph(operations, dynamoMeta, postgresMeta, mysqlMeta = [],
             timeoutSec: fn.timeoutSec,
             envVarKeys: fn.envVarKeys,
             triggers: fn.triggers,
+            roleArn: fn.roleArn,
+            allowedServices: fn.allowedServices,
         });
         // Add trigger edges from source → lambda (only for enabled/active mappings)
         for (const trigger of fn.triggers ?? []) {

package/dist/server/index.js

@@ -132,6 +132,31 @@ export function createMcpServer() {
                 String(meta?.callerFunctions ?? '').includes(functionName));
         });
         const allTriggers = lambdaNode?.type === 'lambda' ? (lambdaNode.triggers ?? []) : [];
+        // Compute missing IAM permissions inline from graph data
+        const allowedServices = lambdaNode?.type === 'lambda' ? lambdaNode.allowedServices : undefined;
+        let missingPermissions;
+        if (allowedServices && !allowedServices.includes('*') && funcNode) {
+            const nodeMap = new Map(currentGraph.nodes.map((n) => [n.id, n]));
+            const needed = new Set();
+            for (const edge of outEdges) {
+                const target = nodeMap.get(edge.to);
+                if (!target)
+                    continue;
+                if ((edge.type === 'query' || edge.type === 'scan') &&
+                    target.type === 'table' &&
+                    target.databaseType === 'dynamodb')
+                    needed.add('dynamodb');
+                else if (edge.type === 'reads_secret')
+                    needed.add('secretsmanager');
+                else if (edge.type === 'reads_parameter')
+                    needed.add('ssm');
+                else if (edge.type === 'publishes_to' && target.type === 'queue')
+                    needed.add('sqs');
+                else if (edge.type === 'publishes_to' && target.type === 'topic')
+                    needed.add('sns');
+            }
+            missingPermissions = [...needed].filter((s) => !allowedServices.includes(s));
+        }
         return toText({
             function: functionName,
             found: true,
@@ -151,6 +176,7 @@ export function createMcpServer() {
                     targetType: target?.type,
                 };
             }),
+            ...(missingPermissions !== undefined ? { missingPermissions } : {}),
             issues: relatedFindings.map((f) => ({
                 severity: f.severity,
                 issue: f.issue,
@@ -343,6 +369,7 @@ export function createMcpServer() {
                 timeoutSec: l.timeoutSec,
                 envVarCount: l.envVarKeys?.length ?? 0,
                 envVarKeys: l.envVarKeys,
+                roleArn: l.roleArn,
                 triggers: (l.triggers ?? []).map((t) => ({
                     type: t.type,
                     source: t.sourceName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "infrawise",
-  "version": "0.12.6",
+  "version": "0.13.0",
   "mcpName": "io.github.Sidd27/infrawise",
   "description": "CLI-first infrastructure intelligence platform — analyzes DynamoDB, PostgreSQL, MySQL, MongoDB, SQS, SNS, SSM, Secrets Manager, Lambda, S3, API Gateway, CloudWatch Logs and exposes findings as an MCP server for Claude Code",
   "keywords": [
@@ -78,6 +78,7 @@
     "@aws-sdk/client-cloudwatch-logs": "^3.1048.0",
     "@aws-sdk/client-dynamodb": "^3.1048.0",
     "@aws-sdk/client-eventbridge": "^3.1051.0",
+    "@aws-sdk/client-iam": "^3.1073.0",
     "@aws-sdk/client-lambda": "^3.1048.0",
     "@aws-sdk/client-rds": "^3.1048.0",
     "@aws-sdk/client-s3": "^3.1048.0",