---
title: "Discussion on \"Catching over-permissive IAM in the pull request, not in production\" | Hashnode"
description: "Discussion on \"Catching over-permissive IAM in the pull request, not in production\". Why I built Cloud Policy Guard: a small Python CLI that reads a Terraform plan, scores IAM risk, and fails the pipeline before a wildcard policy ever reaches AWS."
url: "https://hashnode.com/posts/catching-over-permissive-iam-in-the-pull-request/6ad0d4e2bd52b4e4b431f0bd"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Catching over-permissive IAM in the pull request, not in production](https://devseccloud.hashnode.dev/catching-over-permissive-iam-in-the-pull-request?utm_source=hashnode&utm_medium=feed)

Why I built Cloud Policy Guard: a small Python CLI that reads a Terraform plan, scores IAM risk, and fails the pipeline before a wildcard policy ever reaches AWS.

Oct 15 · 3 min read · devseccloud.hashnode.dev  
Read the article

-   [#terraform](https://hashnode.com/tag/terraform)
-   [#aws-iam](https://hashnode.com/tag/aws-iam)
-   [#policy-as-code](https://hashnode.com/tag/policy-as-code)
-   [#ci-cd](https://hashnode.com/tag/ci-cd)

## Written by

[Sulakshana Karunarathne](https://hashnode.com/@sulaa29)

@sulaa29 · Colombo

  
[View profile](https://hashnode.com/@sulaa29)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.