c4.4 Build an IAM policy generation pipeline
With dozens of apps and accounts, IAM governance needs a pipeline. Let teams propose least-privilege policies as code, have an automated check reject over-broad access (wildcards), then approve and deploy — giving teams autonomy while keeping the security team out of the critical path.
Implementation guidance
IAM as code
When you have many apps and accounts, ad-hoc policy creation does not scale. Start with teams defining the IAM policies they need as AWS CloudFormation (or CDK) templates, reviewed, approved, and version-controlled in Git, then deployed.
Add a governance pipeline
To give teams autonomy and reduce the security team's operational load, let teams propose a new policy (respecting least privilege) and run an automated check — for example an AWS Lambda function — that rejects unreasonable requests such as "Action": "" or "Resource": "". Security can then approve automatically or manually depending on the environment and policy, and the pipeline deploys it. AWS CodePipeline can orchestrate these steps just as it does for application delivery. See How to manage security governance using DevOps methodologies.
Why it helps
Automated policy governance keeps least privilege enforced at scale, gives teams fast self-service, and frees the security team from being a manual bottleneck for every policy change.
How to validate
- Are IAM policies defined as code, version-controlled, and reviewed before deployment?
- Does an automated check reject over-broad requests (wildcard actions/resources) in the pipeline?
- Do teams have a self-service path to propose policies without the security team being a manual bottleneck?
Threats addressed
- Manual, ad-hoc IAM policy creation at scale leads to inconsistent, over-permissive policies and makes the security team a bottleneck — so teams route around them or over-grant to move fast.
AWS services
AWS IAM 
AWS CodePipeline 
AWS Lambda