iam-policy-validator 1.0.2__py3-none-any.whl → 1.0.4__py3-none-any.whl

{iam_policy_validator-1.0.2.dist-info → iam_policy_validator-1.0.4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.0.2
+Version: 1.0.4
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs
@@ -40,7 +40,7 @@ Requires-Dist: types-boto3; extra == 'dev'
 Requires-Dist: types-pyyaml; extra == 'dev'
 Description-Content-Type: text/markdown
 
-# IAM Validator
+# IAM Policy Validator
 
 A high-performance GitHub Action and Python CLI tool that validates AWS IAM policies for correctness and security by checking against the official AWS Service Reference API.
 
@@ -85,9 +85,11 @@ A high-performance GitHub Action and Python CLI tool that validates AWS IAM poli
 
 ## Quick Start
 
-### As a GitHub Action
+### As a GitHub Action (Recommended) ⭐
 
-#### Option 1: Basic Validation (Custom Checks Only)
+The easiest way to use IAM Policy Validator is as a GitHub Action in your workflows.
+
+#### Basic Validation
 
 Create `.github/workflows/iam-policy-validator.yml`:
 
@@ -108,38 +110,23 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v3
-
-      - name: Install dependencies
-        run: uv sync
+        uses: actions/checkout@v5
 
       - name: Validate IAM Policies
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          uv run iam-validator validate \
-            --path ./policies/ \
-            --github-comment \
-            --github-review \
-            --fail-on-warnings
+        uses: boogy/iam-policy-validator@v1
+        with:
+          path: policies/
+          post-comment: true
+          create-review: true
+          fail-on-warnings: true
 ```
 
-#### Option 2: Sequential Validation (Recommended) ⭐
+#### With AWS Access Analyzer
 
-Run AWS Access Analyzer first, then custom checks if it passes:
+Use AWS's official policy validation service:
 
 ```yaml
-name: Sequential IAM Policy Validation
+name: IAM Policy Validation with Access Analyzer
 
 on:
   pull_request:
@@ -156,7 +143,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -164,94 +151,20 @@ jobs:
           role-to-assume: arn:aws:iam::123456789012:role/GitHubActionsRole
           aws-region: us-east-1
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Validate with Access Analyzer
+        uses: boogy/iam-policy-validator@v1
         with:
-          python-version: '3.12'
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v3
-
-      - name: Install dependencies
-        run: uv sync
-
-      - name: Sequential Validation
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          # Posts 2 separate PR comments:
-          # 1. Access Analyzer results (immediate)
-          # 2. Custom validation (only if Access Analyzer passes)
-          uv run iam-validator analyze \
-            --path ./policies/ \
-            --github-comment \
-            --run-all-checks \
-            --github-review \
-            --fail-on-warnings
-```
-
-**Why Sequential Validation?**
-- ✅ Access Analyzer validates first (fast, official AWS validation)
-- ✅ If errors found, stops immediately (saves time)
-- ✅ Only runs custom checks if Access Analyzer passes
-- ✅ Two separate PR comments for clear separation
-
-#### Option 3: Multiple Paths
-
-Validate policies across multiple directories and files:
-
-```yaml
-name: Multi-Path IAM Policy Validation
-
-on:
-  pull_request:
-    paths:
-      - 'iam/**/*.json'
-      - 's3-policies/**/*.json'
-      - 'lambda-policies/**/*.json'
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Install uv
-        uses: astral-sh/setup-uv@v3
-
-      - name: Install dependencies
-        run: uv sync
-
-      - name: Validate Multiple Paths
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          uv run iam-validator validate \
-            --path ./iam/ \
-            --path ./s3-policies/ \
-            --path ./lambda-policies/special-policy.json \
-            --github-comment \
-            --github-review \
-            --fail-on-warnings
+          path: policies/
+          use-access-analyzer: true
+          run-all-checks: true
+          post-comment: true
+          create-review: true
+          fail-on-warnings: true
 ```
 
-#### Option 4: Custom Policy Checks in GitHub Actions
+#### Custom Policy Checks
 
-Use custom policy checks to enforce specific security requirements:
+Enforce specific security requirements:
 
 ```yaml
 name: IAM Policy Security Validation
@@ -262,7 +175,7 @@ on:
       - 'policies/**/*.json'
 
 jobs:
-  validate-with-custom-checks:
+  validate-security:
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -271,7 +184,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v4
@@ -281,7 +194,7 @@ jobs:
 
       # Prevent dangerous actions
       - name: Check for Dangerous Actions
-        uses: boogy/iam-policy-auditor@v1
+        uses: boogy/iam-policy-validator@v1
         with:
           path: policies/
           use-access-analyzer: true
@@ -291,7 +204,7 @@ jobs:
 
       # Check S3 bucket policies for public access
       - name: Check S3 Public Access
-        uses: boogy/iam-policy-auditor@v1
+        uses: boogy/iam-policy-validator@v1
         with:
           path: s3-policies/
           use-access-analyzer: true
@@ -309,7 +222,7 @@ jobs:
           path: baseline
 
       - name: Check for New Access
-        uses: boogy/iam-policy-auditor@v1
+        uses: boogy/iam-policy-validator@v1
         with:
           path: policies/role-policy.json
           use-access-analyzer: true
@@ -318,46 +231,137 @@ jobs:
           fail-on-warnings: true
 ```
 
-See [examples/github-actions/](examples/github-actions/) for more workflow examples including resource policies, multi-region validation, and custom policy checks.
+#### Multiple Paths
+
+Validate policies across multiple directories:
+
+```yaml
+- name: Validate Multiple Paths
+  uses: boogy/iam-policy-validator@v1
+  with:
+    path: |
+      iam/
+      s3-policies/
+      lambda-policies/special-policy.json
+    post-comment: true
+    fail-on-warnings: true
+```
+
+#### Custom Configuration
+
+Use a custom configuration file to customize validation rules:
+
+```yaml
+name: IAM Policy Validation with Custom Config
+
+on:
+  pull_request:
+    paths:
+      - 'policies/**/*.json'
+      - '.iam-validator.yaml'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Validate with Custom Config
+        uses: boogy/iam-policy-validator@v1
+        with:
+          path: policies/
+          config-file: .iam-validator.yaml
+          post-comment: true
+          create-review: true
+          fail-on-warnings: true
+```
+
+**Example `.iam-validator.yaml`:**
+```yaml
+settings:
+  fail_fast: false
+  enable_builtin_checks: true
+
+# Custom check configurations
+security_best_practices_check:
+  enabled: true
+  wildcard_action_check:
+    enabled: true
+    severity: high
+
+action_condition_enforcement_check:
+  enabled: true
+  severity: critical
+  action_condition_requirements:
+    - actions:
+        - "iam:PassRole"
+      severity: critical
+      required_conditions:
+        - condition_key: "iam:PassedToService"
+```
+
+See [iam-validator.yaml](iam-validator.yaml) for a complete configuration example.
+
+### GitHub Action Inputs
+
+| Input                         | Description                                                            | Required | Default           |
+| ----------------------------- | ---------------------------------------------------------------------- | -------- | ----------------- |
+| `path`                        | Path(s) to IAM policy file or directory (newline-separated)            | Yes      | -                 |
+| `config-file`                 | Path to custom configuration file (iam-validator.yaml)                 | No       | ""                |
+| `fail-on-warnings`            | Fail validation if warnings are found                                  | No       | `false`           |
+| `post-comment`                | Post validation results as PR comment                                  | No       | `true`            |
+| `create-review`               | Create line-specific review comments on PR                             | No       | `true`            |
+| `format`                      | Output format (console, json, markdown, sarif, csv, html)              | No       | `console`         |
+| `output-file`                 | Path to save output file                                               | No       | ""                |
+| `recursive`                   | Recursively search directories for policy files                        | No       | `true`            |
+| `use-access-analyzer`         | Use AWS IAM Access Analyzer for validation                             | No       | `false`           |
+| `access-analyzer-region`      | AWS region for Access Analyzer                                         | No       | `us-east-1`       |
+| `policy-type`                 | Policy type (IDENTITY_POLICY, RESOURCE_POLICY, SERVICE_CONTROL_POLICY) | No       | `RESOURCE_POLICY` |
+| `run-all-checks`              | Run custom checks after Access Analyzer                                | No       | `false`           |
+| `check-access-not-granted`    | Actions that should NOT be granted (space-separated)                   | No       | ""                |
+| `check-access-resources`      | Resources to check with check-access-not-granted                       | No       | ""                |
+| `check-no-new-access`         | Path to baseline policy to compare against                             | No       | ""                |
+| `check-no-public-access`      | Check that resource policies do not allow public access                | No       | `false`           |
+| `public-access-resource-type` | Resource type(s) for public access check                               | No       | `AWS::S3::Bucket` |
+
+See [examples/github-actions/](examples/github-actions/) for more workflow examples.
 
 ### As a CLI Tool
 
+Install and use locally for development:
+
 ```bash
-# Clone and install
-git clone https://github.com/boogy/iam-policy-auditor.git
-cd iam-policy-auditor
-uv sync
+# Install from PyPI
+pip install iam-policy-validator
+
+# Or install with pipx (recommended for CLI tools)
+pipx install iam-policy-validator
 
 # Validate a single policy
-uv run iam-validator validate --path policy.json
+iam-validator validate --path policy.json
 
 # Validate all policies in a directory
-uv run iam-validator validate --path ./policies/
+iam-validator validate --path ./policies/
 
-# Validate multiple paths (files and directories)
-uv run iam-validator validate --path policy1.json --path ./policies/ --path ./more-policies/
+# Validate multiple paths
+iam-validator validate --path policy1.json --path ./policies/ --path ./more-policies/
 
 # Generate JSON output
-uv run iam-validator validate --path ./policies/ --format json --output report.json
-
-# Post validation results to a PR with line-specific comments
-uv run iam-validator validate --path ./policies/ --github-comment --github-review
-
-# Two-step workflow: generate report, then post to PR
-uv run iam-validator validate --path ./policies/ --format json --output report.json
-uv run iam-validator post-to-pr --report report.json
+iam-validator validate --path ./policies/ --format json --output report.json
 
 # Validate with AWS IAM Access Analyzer
-uv run iam-validator analyze --path policy.json
+iam-validator analyze --path policy.json
 
 # Analyze with specific region and profile
-uv run iam-validator analyze --path policy.json --region us-west-2 --profile my-profile
+iam-validator analyze --path policy.json --region us-west-2 --profile my-profile
 
-# Post Access Analyzer results to PR
-uv run iam-validator analyze --path policy.json --github-comment
-
-# Sequential validation: Access Analyzer → Custom Checks (if AA passes)
-uv run iam-validator analyze \
+# Sequential validation: Access Analyzer → Custom Checks
+iam-validator analyze \
   --path policy.json \
   --github-comment \
   --run-all-checks \
@@ -374,18 +378,18 @@ Verify that policies do NOT grant specific actions (max 100 actions, 100 resourc
 
 ```bash
 # Check that policies don't grant dangerous S3 actions
-uv run iam-validator analyze \
+iam-validator analyze \
   --path ./policies/ \
   --check-access-not-granted s3:DeleteBucket s3:DeleteObject
 
-# Scope to specific resources (wildcards only in resource ID portion)
-uv run iam-validator analyze \
+# Scope to specific resources
+iam-validator analyze \
   --path ./policies/ \
   --check-access-not-granted s3:PutObject \
   --check-access-resources "arn:aws:s3:::production-bucket/*"
 
 # Prevent privilege escalation
-uv run iam-validator analyze \
+iam-validator analyze \
   --path ./policies/ \
   --check-access-not-granted \
     iam:CreateAccessKey \
@@ -397,17 +401,17 @@ uv run iam-validator analyze \
 
 #### 2. CheckNoNewAccess - Validate Policy Updates
 
-Ensure policy changes don't grant new permissions (both policies must be same type):
+Ensure policy changes don't grant new permissions:
 
 ```bash
 # Compare updated policy against baseline
-uv run iam-validator analyze \
+iam-validator analyze \
   --path ./new-policy.json \
   --check-no-new-access ./old-policy.json
 
 # In CI/CD - compare against main branch
 git show main:policies/policy.json > baseline-policy.json
-uv run iam-validator analyze \
+iam-validator analyze \
   --path policies/policy.json \
   --check-no-new-access baseline-policy.json
 ```
@@ -416,39 +420,25 @@ uv run iam-validator analyze \
 
 #### 3. CheckNoPublicAccess - Prevent Public Exposure
 
-Validate that resource policies don't allow public access (RESOURCE_POLICY only, 29+ resource types):
+Validate that resource policies don't allow public access (29+ resource types):
 
 ```bash
 # Check S3 bucket policies
-uv run iam-validator analyze \
+iam-validator analyze \
   --path ./bucket-policy.json \
   --policy-type RESOURCE_POLICY \
   --check-no-public-access \
   --public-access-resource-type "AWS::S3::Bucket"
 
-# Check Lambda function policies
-uv run iam-validator analyze \
-  --path ./lambda-policy.json \
-  --policy-type RESOURCE_POLICY \
-  --check-no-public-access \
-  --public-access-resource-type "AWS::Lambda::Function"
-
-# Check KMS key policies
-uv run iam-validator analyze \
-  --path ./kms-policy.json \
-  --policy-type RESOURCE_POLICY \
-  --check-no-public-access \
-  --public-access-resource-type "AWS::KMS::Key"
-
-# Check multiple resource types at once
-uv run iam-validator analyze \
+# Check multiple resource types
+iam-validator analyze \
   --path ./resource-policies/ \
   --policy-type RESOURCE_POLICY \
   --check-no-public-access \
   --public-access-resource-type "AWS::S3::Bucket" "AWS::Lambda::Function" "AWS::SNS::Topic"
 
 # Check ALL 29 resource types
-uv run iam-validator analyze \
+iam-validator analyze \
   --path ./resource-policies/ \
   --policy-type RESOURCE_POLICY \
   --check-no-public-access \
@@ -464,17 +454,11 @@ uv run iam-validator analyze \
 - **API**: API Gateway REST API
 - **DevOps**: CodeArtifact Domain, Backup Vault, CloudTrail
 
-See [docs/custom-policy-checks.md](docs/custom-policy-checks.md) for complete documentation and examples.
+See [docs/custom-policy-checks.md](docs/custom-policy-checks.md) for complete documentation.
 
 ### As a Python Package
 
-```bash
-# Install from PyPI (once published)
-pip install iam-policy-validator
-
-# Or install from source
-pip install git+https://github.com/boogy/iam-policy-auditor.git
-```
+Use as a library in your Python applications:
 
 ```python
 import asyncio
@@ -496,82 +480,6 @@ async def main():
 asyncio.run(main())
 ```
 
-## Memory Management & Performance
-
-### Streaming Mode (Recommended for Large Policy Sets)
-
-The validator supports two processing modes:
-
-#### 1. **Batch Mode (Default)**
-Loads all policies into memory at once. Best for:
-- Small to medium policy sets (< 100 files)
-- When you need the full summary upfront
-- Local development
-
-#### 2. **Streaming Mode** (`--stream`)
-Processes policies one-by-one. Best for:
-- Large policy sets (100+ files)
-- CI/CD environments (auto-enabled)
-- Limited memory environments
-- Progressive feedback (see results as they come)
-
-```bash
-# Enable streaming mode explicitly
-uv run iam-validator validate --path ./policies/ --stream
-
-# Streaming mode with GitHub PR comments (posts per-file reviews progressively)
-uv run iam-validator validate \
-  --path ./policies/ \
-  --stream \
-  --github-comment \
-  --github-review
-```
-
-**Streaming Benefits:**
-- ✅ **Lower Memory Usage**: Only one policy in memory at a time
-- ✅ **Progressive Feedback**: See results immediately as files are processed
-- ✅ **Partial Results**: Get results even if later files fail
-- ✅ **Better CI/CD Experience**: GitHub PR comments appear progressively
-- ✅ **Auto-enabled in CI**: Automatically detects CI environment
-
-**File Size Limits:**
-- Default max file size: 100MB per policy file
-- Files exceeding limit are skipped with a warning
-- Prevents memory exhaustion from unexpectedly large files
-
-### GitHub Action Memory Optimization
-
-The GitHub Action automatically uses streaming mode in CI environments:
-
-```yaml
-- name: Validate Large Policy Set
-  run: |
-    # Streaming is auto-enabled in CI
-    uv run iam-validator validate \
-      --path ./policies/ \
-      --github-comment \
-      --github-review
-```
-
-## Configuration
-
-### GitHub Action Inputs
-
-| Input              | Description                                                 | Required | Default |
-| ------------------ | ----------------------------------------------------------- | -------- | ------- |
-| `path`             | Path(s) to IAM policy file or directory (newline-separated) | Yes      | -       |
-| `fail-on-warnings` | Fail validation if warnings are found                       | No       | `false` |
-| `post-comment`     | Post validation results as PR comment                       | No       | `true`  |
-| `create-review`    | Create line-specific review comments on PR                  | No       | `true`  |
-
-### Environment Variables
-
-For GitHub integration:
-
-- `GITHUB_TOKEN`: GitHub API token (automatically provided in GitHub Actions)
-- `GITHUB_REPOSITORY`: Repository in format `owner/repo`
-- `GITHUB_PR_NUMBER`: Pull request number
-
 ## Validation Checks
 
 ### 1. Action Validation
@@ -664,156 +572,6 @@ Run 2: Finds 3 issues → Deletes old 5 comments → Posts 3 new comments + upda
 Result: PR always shows current state, no stale comments
 ```
 
-### Post PR Comments
-
-Automatically posts validation results as PR comments:
-
-```python
-async with GitHubIntegration() as github:
-    await github.post_comment(validation_report)
-```
-
-### Line-Specific Comments
-
-Add comments to specific lines in policy files:
-
-```python
-comments = [
-    {
-        "path": "policies/policy.json",
-        "line": 5,
-        "body": "Invalid action detected here",
-    }
-]
-await github.create_review_with_comments(comments)
-```
-
-### Manage Labels
-
-Add or remove labels based on validation results:
-
-```python
-# Add labels
-await github.add_labels(["iam-policy", "security-review"])
-
-# Remove labels
-await github.remove_label("needs-review")
-
-# Set labels (replaces all existing)
-await github.set_labels(["approved", "security-validated"])
-```
-
-### Set Commit Status
-
-Update commit status based on validation:
-
-```python
-await github.set_commit_status(
-    state="success",  # or "error", "failure", "pending"
-    context="IAM Policy Validator",
-    description="All policies validated successfully"
-)
-```
-
-## CLI Usage
-
-### Analyze Command (AWS IAM Access Analyzer)
-
-The `analyze` command uses AWS IAM Access Analyzer's ValidatePolicy API to validate IAM policies. This provides AWS's official policy validation with detailed findings about errors, security warnings, and suggestions.
-
-**New in latest version:** Post results to GitHub PRs and run sequential validation (Access Analyzer → Custom Checks).
-
-**Prerequisites**: You need AWS credentials configured. The tool will use the standard AWS credential chain (environment variables, AWS profile, IAM role, etc.).
-
-```bash
-iam-validator analyze --path PATH [OPTIONS]
-
-Options:
-  --path PATH, -p PATH          Path to IAM policy file or directory (required)
-  --format {console,json,markdown}
-                                Output format (default: console)
-  --output OUTPUT, -o OUTPUT    Output file path (only for json/markdown)
-  --region REGION, -r REGION    AWS region for Access Analyzer (default: us-east-1)
-  --policy-type {IDENTITY_POLICY,RESOURCE_POLICY,SERVICE_CONTROL_POLICY}
-                                Type of IAM policy to validate (default: IDENTITY_POLICY)
-  --profile PROFILE             AWS profile name to use for credentials
-  --github-comment              Post Access Analyzer results as GitHub PR comment
-  --run-all-checks              Run full validation if Access Analyzer passes
-  --github-review               Add line-specific review comments (requires --run-all-checks)
-  --no-recursive                Don't recursively search directories
-  --fail-on-warnings            Fail validation if warnings are found
-  --verbose, -v                 Enable verbose logging
-```
-
-**Examples**:
-
-```bash
-# Analyze a single identity policy
-iam-validator analyze --path policy.json
-
-# Analyze an S3 bucket policy (resource policy)
-iam-validator analyze --path bucket-policy.json --policy-type RESOURCE_POLICY
-
-# Analyze multiple paths
-iam-validator analyze --path ./iam/ --path ./s3-policies/ --path bucket-policy.json
-
-# Analyze with specific AWS profile and region
-iam-validator analyze --path policy.json --profile prod --region us-west-2
-
-# Post Access Analyzer results to PR
-iam-validator analyze --path policy.json --github-comment
-
-# Sequential validation: Run Access Analyzer, then custom checks if it passes
-iam-validator analyze \
-  --path policy.json \
-  --github-comment \
-  --run-all-checks \
-  --github-review
-
-# Generate JSON output
-iam-validator analyze --path ./policies/ --format json --output analyzer-report.json
-
-# Fail on any finding (including warnings and suggestions)
-iam-validator analyze --path policy.json --fail-on-warnings
-```
-
-**Access Analyzer Finding Types**:
-- **ERROR**: Syntax errors or invalid policy elements that prevent the policy from working
-- **SECURITY_WARNING**: Security issues that should be addressed
-- **WARNING**: Best practice violations or potential issues
-- **SUGGESTION**: Recommendations for policy improvements
-
-### Validate Command
-
-```bash
-iam-validator validate --path PATH [OPTIONS]
-
-Options:
-  --path PATH, -p PATH          Path to IAM policy file or directory (required)
-  --format {console,json,markdown}
-                                Output format (default: console)
-  --output OUTPUT, -o OUTPUT    Output file path (only for json/markdown)
-  --no-recursive                Don't recursively search directories
-  --fail-on-warnings            Fail validation if warnings are found
-  --github-comment              Post validation results as GitHub PR comment
-  --github-review               Create line-specific review comments (requires --github-comment)
-  --verbose, -v                 Enable verbose logging
-```
-
-### Post-to-PR Command
-
-```bash
-iam-validator post-to-pr --report REPORT [OPTIONS]
-
-Options:
-  --report REPORT, -r REPORT    Path to JSON report file (required)
-  --create-review               Create line-specific review comments (default: true)
-  --no-review                   Don't create line-specific review comments
-  --add-summary                 Add summary comment (default: true)
-  --no-summary                  Don't add summary comment
-  --verbose, -v                 Enable verbose logging
-```
-
 ## Example Output
 
 ### Console Output
@@ -857,68 +615,6 @@ Options:
   - 💡 Suggestion: This grants full administrative access. Restrict to specific actions and resources.
 ```
 
-## Development
-
-### Project Structure
-
-```
-iam-policy-auditor/
-├── action.yaml                          # GitHub Action definition
-├── pyproject.toml                       # Python project configuration
-├── iam_validator/                       # Main Python package
-│   ├── iam_validator/
-│   │   ├── __init__.py
-│   │   ├── models.py                   # Pydantic models
-│   │   ├── aws_fetcher.py              # AWS Service Reference API client
-│   │   ├── github_integration.py       # GitHub API client
-│   │   ├── cli.py                      # CLI interface
-│   │   ├── utils.py                    # Utility functions
-│   │   └── core/
-│   │       ├── policy_loader.py        # Policy file loader
-│   │       ├── policy_checks.py        # Validation logic
-│   │       └── report.py               # Report generation
-│   └── pyproject.toml
-└── examples/
-    ├── sample_policy.json              # Valid example
-    └── invalid_policy.json             # Invalid example
-```
-
-### Running Tests
-
-```bash
-cd iam-policy-validator
-uv run pytest
-```
-
-### Type Checking
-
-```bash
-uv run mypy iam_validator/
-```
-
-## Architecture
-
-### AWS Service Reference API
-
-The validator fetches real-time service information from AWS's official service reference API:
-
-```
-https://servicereference.us-east-1.amazonaws.com/
-```
-
-This ensures validation is always up-to-date with the latest AWS services and actions.
-
-### Validation Flow
-
-1. **Load Policies**: Parse JSON/YAML policy files
-2. **Fetch Service Data**: Get service information from AWS API (with caching)
-3. **Validate Actions**: Check each action against service definitions
-4. **Validate Conditions**: Verify condition keys are valid for actions
-5. **Validate Resources**: Check ARN format and structure
-6. **Security Checks**: Identify security best practice violations
-7. **Generate Report**: Create formatted output in desired format
-8. **GitHub Integration**: Post comments/labels to PR (if enabled)
-
 ## 📚 Documentation
 
 **[📖 Complete Documentation →](DOCS.md)**
@@ -949,7 +645,7 @@ Contributions are welcome! We appreciate your help in making this project better
 ### How to Contribute
 
 1. **Read the [Contributing Guide](CONTRIBUTING.md)** - Comprehensive guide for contributors
-2. **Check [existing issues](https://github.com/boogy/iam-policy-auditor/issues)** - Find something to work on
+2. **Check [existing issues](https://github.com/boogy/iam-policy-validator/issues)** - Find something to work on
 3. **Fork the repository** - Create your own copy
 4. **Make your changes** - Follow our code quality standards
 5. **Submit a Pull Request** - We'll review and merge
@@ -958,17 +654,17 @@ Contributions are welcome! We appreciate your help in making this project better
 
 ```bash
 # Clone your fork
-git clone https://github.com/YOUR-USERNAME/iam-policy-auditor.git
-cd iam-policy-auditor
+git clone https://github.com/YOUR-USERNAME/iam-policy-validator.git
+cd iam-policy-validator
 
 # Install dependencies
 uv sync --extra dev
 
 # Run tests
-make test
+uv run pytest
 
-# Run quality checks
-make check
+# Run linting
+uv run ruff check .
 ```
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for detailed instructions.
@@ -980,5 +676,5 @@ This project is licensed under the MIT License - see the [LICENSE](LICENSE) file
 ## 🆘 Support
 
 - **Documentation**: Check the [docs/](docs/) directory
-- **Issues**: Report bugs or request features via [GitHub Issues](https://github.com/boogy/iam-policy-auditor/issues)
-- **Questions**: Ask questions in [GitHub Discussions](https://github.com/boogy/iam-policy-auditor/discussions)
+- **Issues**: Report bugs or request features via [GitHub Issues](https://github.com/boogy/iam-policy-validator/issues)
+- **Questions**: Ask questions in [GitHub Discussions](https://github.com/boogy/iam-policy-validator/discussions)

{iam_policy_validator-1.0.2.dist-info → iam_policy_validator-1.0.4.dist-info}/RECORD

@@ -1,6 +1,6 @@
 iam_validator/__init__.py,sha256=APnMR3Fu4fHhxfsHBvUM2dJIwazgvLKQbfOsSgFPidg,693
 iam_validator/__main__.py,sha256=to_nz3n_IerJpVVZZ6WSFlFR5s_06J0csfPOTfQZG8g,197
-iam_validator/__version__.py,sha256=EXSYpe7P3y8CzXAZe919MfWvVsf39-4BnKaidca1zQo,206
+iam_validator/__version__.py,sha256=YOIURWR5ocuvaQTQgwFi1XjHm_ifJDzicMOQSJZqmZc,206
 iam_validator/checks/__init__.py,sha256=q-_rIYGZJMjsiHK-R_3CbSUCBVGN5e137LPNDnMRZmw,841
 iam_validator/checks/action_condition_enforcement.py,sha256=3V8Wnz6BYnataKzuFMx8fHukVjzpIZaVfde9-RqZjPc,25357
 iam_validator/checks/action_validation.py,sha256=KbUw1SV-2nN-HtLlj3zrE6sdd0z8iAF0ubqz35Vwb7c,6921
@@ -20,7 +20,7 @@ iam_validator/core/access_analyzer_report.py,sha256=iTIFKul6zQZd2qBg8V6zaDNPMKF8
 iam_validator/core/aws_fetcher.py,sha256=fUCIMItIWmrbgsoVCz_9Oe5k3SjuXBlNBVwQ60IWwns,25492
 iam_validator/core/aws_global_conditions.py,sha256=ADVcMEWhgvDZWdBmRUQN3HB7a9OycbTLecXFAy3LPbo,5837
 iam_validator/core/check_registry.py,sha256=wXg4Yw5LJ-rAVLiPUIJOtw8Y49Q1PY00Zbu37LzyjHY,15477
-iam_validator/core/cli.py,sha256=T1SzPTu9vzk29Mey3kMfGJkE4hXTNY6ZrOsj8udDv3o,3140
+iam_validator/core/cli.py,sha256=5UHsHS8o7Fkag4d6MNaaqjCFSGu8evCIbtpa81591lE,3831
 iam_validator/core/config_loader.py,sha256=k4D5TT_D6B9N8BbIEg0nE3wUXu0naFLHOVVJsjYZzh4,14880
 iam_validator/core/models.py,sha256=SUEbxDUtkX1uvgMy6-LPzomyGu82PTpXdDXZ9RKqfTY,9655
 iam_validator/core/policy_checks.py,sha256=xK5CntsEKVDgN27uIdQ92jCL97t7eBqOk0SChWU9cgw,23872
@@ -38,8 +38,8 @@ iam_validator/core/formatters/sarif.py,sha256=tqp8g7RmUh0HRk-kKDaucx4sa-5I9ikgkS
 iam_validator/integrations/__init__.py,sha256=7Hlor_X9j0NZaEjFuSvoXAAuSKQ-zgY19Rk-Dz3JpKo,616
 iam_validator/integrations/github_integration.py,sha256=bKs94vNT4PmcmUPUeuY2WJFhCYpUY2SWiBP1vj-andA,25673
 iam_validator/integrations/ms_teams.py,sha256=t2PlWuTDb6GGH-eDU1jnOKd8D1w4FCB68bahGA7MJcE,14475
-iam_policy_validator-1.0.2.dist-info/METADATA,sha256=neUwHkkpr3YwMAQPjcuuwPY6F66Cj4XdEt5-T-WekyE,31445
-iam_policy_validator-1.0.2.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
-iam_policy_validator-1.0.2.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
-iam_policy_validator-1.0.2.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
-iam_policy_validator-1.0.2.dist-info/RECORD,,
+iam_policy_validator-1.0.4.dist-info/METADATA,sha256=QQAQsAQCDiPen37apynaUzYjOUmiTpn8NYgrM6C7l0E,22070
+iam_policy_validator-1.0.4.dist-info/WHEEL,sha256=qtCwoSJWgHk21S1Kb4ihdzI2rlJ1ZKaIurTj_ngOhyQ,87
+iam_policy_validator-1.0.4.dist-info/entry_points.txt,sha256=8HtWd8O7mvPiPdZR5YbzY8or_qcqLM4-pKaFdhtFT8M,62
+iam_policy_validator-1.0.4.dist-info/licenses/LICENSE,sha256=AMnbFTBDcK4_MITe2wiQBkj0vg-jjBBhsc43ydC7tt4,1098
+iam_policy_validator-1.0.4.dist-info/RECORD,,

iam_validator/__version__.py

@@ -3,5 +3,5 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.0.2"
+__version__ = "1.0.4"
 __version_info__ = tuple(int(part) for part in __version__.split("."))

iam_validator/core/cli.py

@@ -10,18 +10,24 @@ from iam_validator import __version__
 from iam_validator.commands import ALL_COMMANDS
 
 
-def setup_logging(verbose: bool = False) -> None:
+def setup_logging(log_level: str | None = None, verbose: bool = False) -> None:
     """Setup logging configuration.
 
     Args:
-        verbose: Enable verbose logging
+        log_level: Log level from CLI argument (debug, info, warning, error, critical)
+        verbose: Enable verbose logging (deprecated, use --log-level debug instead)
 
     Environment Variables:
         LOG_LEVEL: Set log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
-                   Overrides the --verbose flag if set
+
+    Priority:
+        1. --log-level CLI argument (highest priority)
+        2. LOG_LEVEL environment variable
+        3. --verbose flag (sets DEBUG level)
+        4. Default: WARNING (lowest priority)
     """
     # Check for LOG_LEVEL environment variable
-    log_level_str = os.getenv("LOG_LEVEL", "").upper()
+    env_log_level = os.getenv("LOG_LEVEL", "").upper()
 
     # Map string to logging level
     level_map = {
@@ -32,13 +38,15 @@ def setup_logging(verbose: bool = False) -> None:
         "CRITICAL": logging.CRITICAL,
     }
 
-    # Priority: LOG_LEVEL env var > --verbose flag > default (INFO)
-    if log_level_str in level_map:
-        level = level_map[log_level_str]
+    # Priority: CLI --log-level > LOG_LEVEL env var > --verbose flag > default (WARNING)
+    if log_level:
+        level = level_map[log_level.upper()]
+    elif env_log_level in level_map:
+        level = level_map[env_log_level]
     elif verbose:
         level = logging.DEBUG
     else:
-        level = logging.INFO
+        level = logging.WARNING
 
     logging.basicConfig(
         level=level,
@@ -66,6 +74,14 @@ def main() -> int:
         help="Show version information and exit",
     )
 
+    # Add global log level argument
+    parser.add_argument(
+        "--log-level",
+        choices=["debug", "info", "warning", "error", "critical"],
+        default=None,
+        help="Set logging level (default: warning)",
+    )
+
     subparsers = parser.add_subparsers(dest="command", help="Command to run")
 
     # Register all commands
@@ -88,8 +104,9 @@ def main() -> int:
         return 1
 
     # Setup logging
+    log_level = getattr(args, "log_level", None)
     verbose = getattr(args, "verbose", False)
-    setup_logging(verbose)
+    setup_logging(log_level, verbose)
 
     # Execute command
     try: