Every application deployed on Amazon Web Services (AWS) requires Identity and Access Management (IAM) policies that specify which API actions the application is authorized to perform. AWS offers managed policies as a convenience to simplify policy authoring. However, these policies are designed to cover common scenarios which can lead to unnecessarily broad permissions beyond what a specific use case requires. AI coding assistants offer an alternative, but can be unreliable: they hallucinate invalid policy content, and lag behind newly launched services and APIs. Moreover, some organizations distrust nondeterministic processes for security-critical artifacts such as access policies. We present IAM Policy Autopilot (IPA), a deterministic static-analysis tool that generates IAM policies by examining API usage in Python, Java, Go, and TypeScript/JavaScript code. The tool occupies a middle ground between hand-crafted least-privilege policies, which require deep IAM expertise, and potentially overpermissive managed policy selection. It implements a three-phase pipeline that parses source files to identify AWS SDK calls via AST pattern matching; maps SDK operations to the required permissions by consulting authoritative, up-to-date service metadata; and synthesizes policy documents with provenance, tracing each permission to its origin in the source code. We evaluate IPA in two settings: (1) on 10 synthetic benchmark applications across four languages, comparing generated policies against minimal baseline policies, AI-generated policies, and an optimal selection of managed policies. IPA-generated policies prove sufficient to run 9 of the 10 applications; and (2) on a production-style multi-service chatbot application in Python, where IPA-generated policies prove sufficient for executing 11 of 12 handlers. Our findings show that policies generated by our tool are sufficient to run applications on a level similar to, or outperforming, AI-generated policies, while being generated deterministically. On average, the policies permit about an order of magnitude fewer permissions than the optimal selection of managed policies and about 60% fewer permissions than an expert developer-authored set of policies, indicating that IAM Policy Autopilot provides a good starting point when writing application policies.
