David Kerber pulled up a policy with 30,000 characters in it — right at the edge of what AWS will let you attach to a role — and ran it through a tool called IAM Shrink. A few seconds later it was 25,000 characters. He ran it again: 23,000. One more pass, and it dropped to 7,000. Same permissions, a quarter of the size, no additional attack surface.
That's the kind of problem engineers hit constantly and rarely talk about: AWS IAM policies quickly become unreadable and oversized, and fixing them by hand means collapsing action lists into wildcards without accidentally granting permissions you didn't intend. Kerber built a tool for it because he got tired of doing it manually during consulting work. He's now a Cloud Software Architect at Act Security, which acquired his open-source project, Cloud Copilot, last month and folded it into a new free toolkit called Amphi.
Every tool in Amphi follows the same philosophy: do one thing, do it well, run it in the browser or from the command line, and never send the policy data anywhere. IAM Expand takes a wildcard string like s3:*et*ob* and shows exactly which actions it matches as you type it. It can also invert a policy — take an allow, not action statement and spit back the actual list of what's allowed, pulled from AWS documentation that refreshes daily. IAM Convert turns a policy into Terraform, which Kerber built for the same reason as IAM Shrink: he was hand-converting policies too often. Chain the two together in a CI pipeline — shrink, then convert — and your Git history still shows what you actually intended to grant, even after the policy's been compressed for size.
The policy tester is the one built for how developers already think. Paste in a policy, write expectations against it — "this call should be denied," "this call should be allowed" — and the simulator tells you which statement matched and why. Edit the policy live and the results update as you type. Kerber described it as writing red-green tests for a permission set rather than guessing how it behaves.
The most complex tool handles service control policies and resource control policies — organization-wide rules that can govern every request across hundreds of AWS accounts at once. Kerber's blunt about how well understood these are in practice: "Nobody really understands them. They just think they do — including me." His answer is to run every condition in the policy against every other condition and generate a full truth table. One example he pulled up produced 108 unique permutations, each one showing exactly which combination of conditions leads to an allow or a deny.
Then there's the pair built for scale: IAM Collect pulls every policy type from every account you point it at — Kerber said some users run the free version across 7,000 to 8,000 AWS accounts at a time — and IAM Lens queries that data to determine who can actually do what. Ask it who can access a specific S3 bucket, and it runs roughly 20,000 simulations to return every principal with access, along with which objects they can access. Ask the reverse — what can this one role do — and it merges every attached policy, guardrail, and resource policy into a single answer. Kerber's framing for why that matters: "If an auditor asks you to prove who has access to a bucket with driver's license photos in it, this does that. And it scales. And it's free."
I asked what reachability mapping is actually telling an engineer. His answer was more direct than most vendor pitches: it's showing risk. "The first question is who can do it. The second question is, should they? The delta between those two is risk — and it's not a matter of if that gets exploited. It's a matter of when."
Not everything got a confident answer, and that's worth noting on its own. Asked where Amphi overlaps with Permit.io or Sysdig, Kerber said flatly he doesn't know either tool well enough to compare. He couldn't name a customer. And while Act's commercial platform already covers Azure and GCP alongside AWS, he wouldn't commit to whether the open-source tools ever will — "I don't know one way or another whether we'll pursue that."
The commercial boundary is at least clear. The open-source project stays AGPL: free to run inside your own company, off-limits if you're building a product to resell. Act's paid platform is the bigger, multi-cloud version — AWS, Azure, GCP, identity, network — and Kerber says acquiring Cloud Copilot rather than building it in-house came down to time. The tool was already validated at enterprise scale, the edge cases were already worked out, and in security, speed matters more than pride of authorship. He also says open-source contributions have picked up since the acquisition, not slowed down — Cloud Copilot went from a one-person side project to something with real backing.
His closing point is the one to sit with: the industry's been on a least-privilege journey for years, but the urgency just went up. "An attacker's going to get in, and they're going to exploit every access path you haven't closed." Free tooling that shows you exactly where those paths are is a reasonable bet regardless of which platform eventually wins.