# IAM Policy Complexity Calculator AI Agent Connect

> Deterministic AWS IAM policy size and complexity analyzer.

## Overview
- **Category:** security
- **Price:** Free
- **Endpoint:** https://edge.vinkius.com/vk_preview_OPphkP7pg6uY1sfMgyKCNSbJqosg7Joi5GEZe7HW/ai-agent-connect
- **Tags:** iam, aws, security, policy, compliance

## Description

This MCP server provides a suite of tools to analyze AWS Identity and Access Management (IAM) configurations. It allows AI agents to calculate exact policy byte sizes using `analyze_policy_structure`, verify if users, roles, or groups have exceeded policy attachment limits with `check_entity_limits`, simulate access decisions via `simulate_access`, and monitor account-wide capacity with `audit_account_capacity`. It helps ensure IAM policies stay within character limits and adhere to AWS governance rules.

## Tools

### analyze_policy_structure
Calculate the exact byte size of a provided IAM policy and check if it violates character-based constraints

### audit_account_capacity
Check if the AWS account is approaching its cumulative limits for managed policies

### check_entity_limits
Determine if an IAM entity has exceeded its allowed number of attached managed or inline policies

### simulate_access
Simulate the outcome of a specific action request based on the hierarchy of IAM evaluation logic

## Prompt Examples

**Prompt:** 
```
Calculate the size of this IAM policy: [{"Effect": "Allow", "Action": "s3:*", "Resource": "*"}]
```

**Response:** 
```
The total size of the provided policy is 62 bytes, which is well within the limits.
```

**Prompt:** 
```
Will a user with an explicit deny on s3:PutObject be allowed to upload a file?
```

**Response:** 
```
No, the action is denied because an explicit deny always overrides an explicit allow in the IAM evaluation logic.
```

**Prompt:** 
```
Check if a role with 12 managed policies is over the limit.
```

**Response:** 
```
Yes, the role is over the limit. Users and roles are restricted to a maximum of 10 managed policies.
```

## Frequently Asked Questions

**How do I check if my IAM policy is too large?**
You can use the `analyze_policy_structure` tool to calculate the exact byte size of your policy statements and check for limit violations.

**Can this tool simulate permission denials?**
Yes, the `simulate_access` tool evaluates the IAM hierarchy, including explicit denies, to determine if an action is allowed or denied.

**What are the limits for managed policies?**
Managed policies have a character limit of 6144. You can use `check_entity_limits` to see if you have reached the maximum number of attached policies for your specific entity type.