I audited Prowler's 48 IAM checks against a linter I built, and found a real gap

A few weeks ago I was prepping for a Cloud Security Engineer interview and built a small exercise: a Python function that scans an AWS IAM policy document and flags a few classic risks: wildcard actions, wildcard resources, unrestricted iam:PassRole. It was meant to be throwaway interview prep.

It didn't stay throwaway. I kept adding rules, and it turned into iam-lint, a real, tested, CLI-installable IAM policy scanner. Then, wanting to make sure I wasn't just reinventing something that already existed, I sat down and read through all 48 of Prowler's existing IAM checks. That comparison turned up a genuine, non-trivial gap, which is really the interesting part of this post.

What iam-lint checks

Seven rules, each backed by tests:

Rule