API

What changed in the last day, as one line per policy:

curl -s --compressed https://iamtrail.com/api/v1/changes.json \
  | jq -r '.changes[]
      | select(.date > (now - 86400 | todate))
      | "\(.policyName) \(.versionId): \(.summary)"'

Every never-before-seen action AWS has shipped recently, which is usually the first public sign of an unannounced service:

curl -s --compressed https://iamtrail.com/api/v1/changes.json \
  | jq -r '.changes[] | select(.newActions | length > 0)
      | "\(.date[0:10]) \(.policyName): \(.newActions | join(", "))"'

New AWS services in the latest re:Invent season:

curl -s --compressed https://iamtrail.com/api/v1/reinvent.json \
  | jq -r '.editions[0].services[] | "\(.firstSeen) \(.prefix) \(.name // "")"'

Pre-re:Invent What's New posts in the latest season:

curl -s --compressed https://iamtrail.com/api/v1/reinvent.json \
  | jq -r '.editions[0].whatsNewPosts.items[]
      | select(.timing == "before")
      | "\(.date) \(.headline)"'

Which managed policies grant a given action:

curl -s --compressed https://iamtrail.com/api/v1/actions.json \
  | jq -r '.actions["kms:Decrypt"].actionAllowPolicies[]'

Most broad policies grant through wildcards instead. Those live in wildcardGrants, keyed by service prefix, with "*" holding patterns whose prefix is itself a wildcard. Match them the way IAM does, case-insensitively:

curl -s --compressed https://iamtrail.com/api/v1/actions.json \
  | jq -r --arg a "kms:Decrypt" '
      .wildcardGrants as $g
      | ($g[$a | split(":")[0] | ascii_downcase] // {}) + ($g["*"] // {})
      | to_entries[]
      | .key as $p
      | select($a | test("^" + ($p | gsub("\\*"; ".*") | gsub("\\?"; ".")) + "$"; "i"))
      | "\($p): \(.value | join(", "))"'

Fail a pipeline when the account has a critical AWS managed policy attached:

attached=$(aws iam list-policies --scope AWS --only-attached \
  --query 'Policies[].PolicyName' --output json)
critical=$(curl -s --compressed https://iamtrail.com/api/v1/risk.json \
  | jq -r --argjson mine "$attached" \
      '.policies[] | select(.level == "critical" and (.name | IN($mine[]))) | .name')
[ -z "$critical" ] || { echo "Critical AWS managed policies attached: $critical"; exit 1; }

Watch only the policies you actually have attached:

aws iam list-attached-role-policies --role-name my-role \
  | jq -r '.AttachedPolicies[].PolicyName' \
  | while read -r name; do
      curl -s --compressed "https://iamtrail.com/api/v1/policies/${name}.json" \
        | jq -r '"\(.name) \(.versionId) last changed \(.lastModified)"'
    done