Netflix/repokid

Health v2 · maintenance only

Adoption not part of the score

1146 stars · 105 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Repokid is a Python tool from Netflix that enforces least privilege on AWS IAM roles by removing permissions for unused services from inline policies. It uses access advisor data provided by Aardvark and stores role state in DynamoDB.

Use cases

• automatically remove unused permissions from AWS IAM role policies
• enforce least privilege across many AWS accounts
• right-size IAM inline policies based on access advisor usage data
• periodically revoke stale IAM permissions in a multi-account AWS setup
• audit and remediate over-privileged IAM roles

When to choose

• you manage IAM roles at scale across multiple AWS accounts
• you already run Netflix Aardvark to collect CloudTrail access advisor data
• you want automated, scheduled least-privilege remediation of inline policies

When to avoid

• you only need one-off IAM policy audits rather than continuous remediation
• your IAM permissions are managed exclusively through customer-managed policies rather than inline policies
• you cannot deploy the Aardvark data-collection dependency or DynamoDB storage

Facets

cli-tool · maturity active

security cli monitoring security cloud-computing python cloud cli aws-iam least-privilege access-advisor aardvark dynamodb policy-remediation devops docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Netflix/repokid")