Key takeaways

• Amphi is a free, open-source suite covering the full policy lifecycle: reading, testing, simulating, shrinking, converting policies, and querying reachability across your cloud.
  ‍
• Every tool runs client-side in your browser, works offline as a local CLI, or drops into your pipelines with 100% open source code live on GitHub.
  ‍
• Completely free. No login, no email wall, zero friction.

‍
Access is the foundation of cloud security. If permissions are misconfigured, every other control you put in place can be bypassed. Yet true least privilege still feels out of reach for most teams, largely because the developer tools to get there simply haven't existed.

Basic questions still lack straight answers:

• What does s3:GetO* actually grant?
• How can you test every edge case of a policy without deploying it first?
• How do you shrink a policy down to fit character limits without accidentally opening new security holes?

Today, Act Security is launching Amphi: a suite of free, open-source tools designed to solve these exact problems. Built on the Unix philosophy of doing one thing well, Amphi eliminates friction across the entire lifecycle, from reading a policy to shipping it as code.

‍

Amphi builds on Cloud Copilot, the popular open-source AWS IAM tool originally created by David Kerber. Act has officially acquired Cloud Copilot and will actively maintain it as a permanent, free offering for the community.

‍
Seven tools, one open arena

Amphi is a single, open toolkit for evaluating, refining, and deploying cloud policies without the guesswork. Each tool does one thing, does it well, and composes with the others.
‍

1. IAM Expand | Unmask wildcards
‍
Wildcards make policies fast to write, but hide the true exposure they create. IAM Expand resolves a pattern like s3:GetO* down to the explicit actions behind it, so you can see effective access before a policy ever reaches production. It also runs in reverse: --invert shows you everything a pattern does not cover, which is how you catch an overly broad NotAction before an auditor does. Action data comes from iam-data, which refreshes daily, so new AWS actions show up without you doing anything.

‍

2. IAM Truth | Read the Logic
‍
A Service Control Policy rarely tells you what it does on the surface. The real behavior sits in stacked conditions that are painful to trace by reading raw JSON. IAM Truth renders a SCP or RCP as a truth table, showing every combination of conditions and the allow or deny each one produces, so you know what a guardrail blocks before you attach it to an OU and find out the hard way.

‍

3. IAM Simulate | Battle-test before production
‍
Validating evaluation logic across multiple Allow and Deny statements usually means pushing to a live account just to see what happens. IAM Simulate runs the simulation locally against a specific request context and explains how the decision was reached, so you can debug and verify access logic in seconds. No AWS account, no deployment, nothing to clean up afterward.

‍

4. IAM Shrink | Fit the mold
‍
AWS caps a customer managed policy at 6,144 characters and a role's inline policies at 10,240, and hitting that ceiling tends to produce a broken pipeline and a rushed fallback to a broader wildcard. IAM Shrink compresses the policy instead, generating patterns that match the actions you specified and no others, so the permissions the policy grants don't change.
‍

‍

5. IAM Convert | Cast into code

Getting a policy right in raw JSON is only half the job, and hand-translating it into Infrastructure as Code is repetitive work with a real error rate. IAM Convert turns a JSON policy into a Terraform aws_iam_policy_document, a CloudFormation PolicyDocument, or an AWS CDK policy document in TypeScript or Python, in one step.
‍

‍

Bring it all together with IAM Collect & IAM Lens | Map effective access across your cloud

Debugging a policy in isolation only gets you so far - the real answer depends on how every policy in your environment interacts. IAM Collect pulls all live policies directly from your AWS accounts into a single local dataset. IAM Lens then queries that dataset to model reachability across your environment. Working as one, they let you ask plain questions like "Can this role access this S3 bucket?" and get immediate, deterministic answers based on your actual live configuration.

‍
Use it in the browser, in your terminal, or straight from the source

The Amphi meets engineers where they already work:

• ‍In your browser. Paste a policy and get an answer. No login, no trial, no "enter your work email to see results."
  ‍
• ‍In your terminal. Every tool ships as a CLI that reads stdin and writes stdout, which means it drops into CI, into a pipeline, or into whatever shell one-liner you already have. It also installs cleanly in the default AWS CloudShell.
  
  npm install -g @actsecurity/iam-expand
  npm install -g @actsecurity/iam-shrink
  npm install -g @actsecurity/iam-convert
  
  # Expand every wildcard in a policy, then find the actions you care about:
  cat policy.json | iam-expand | grep -n "kms:"
  
  # Shrink an oversized policy as far as it will go, then ship it as Terraform: cat big-policy.json | iam-shrink --iterations 0 | iam-convert > policy.tf
  ‍

• ‍From the source. Every tool is public on GitHub. Open an issue or send a PR - we’d love to have you building alongside us!

• https://github.com/act-security-labs/iam-expand 
• https://github.com/act-security-labs/iam-shrink 
• https://github.com/act-security-labs/iam-truth 
• https://github.com/act-security-labs/iam-simulate 
• https://github.com/act-security-labs/iam-collect 
• https://github.com/act-security-labs/iam-lens 
• https://github.com/act-security-labs/iam-convert
  
  

Built for the community, open by design

Amphi is built for the community, and every part of it is designed to be open, free, and accessible to anyone who needs it.

It was born out of Act's broader commitment to driving open, community-led innovation in cloud access control, giving the engineers who own access full visibility and unrestricted space to work with less manual overhead.

By removing the barriers, opening our decision-making, and building in public with the people who use these tools, we aim to change how the industry approaches cloud permissions.

We're building a foundation where transparency is the default, collaboration shapes the architecture, and access control gets stronger for everyone who touches it. Read Act's full launch announcement for the rest of what we're building.

Step into the Amphi →

‍