# Netflix/repokid

AWS Least Privilege for Distributed, High-Velocity Deployment

Repository: https://github.com/Netflix/repokid
Canonical: https://ross.abutalabs.com/products/repokid
Language: Python
License: Apache-2.0
License Family: permissive
Topics: security, aws
Last push: 2025-11-24T21:16:12+00:00

## Health v2 (maintenance only)
Score: 47/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 53, release rhythm 8, longevity 100
- inputs: {"age_days": 3387, "days_push": 282, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1146, forks 105 (observed 2026-08-28T04:03:45.804304+00:00)

## What it is
Repokid is a Python tool from Netflix that enforces least privilege on AWS IAM roles by removing permissions for unused services from inline policies. It uses access advisor data provided by Aardvark and stores role state in DynamoDB.

## Use cases
- automatically remove unused permissions from AWS IAM role policies
- enforce least privilege across many AWS accounts
- right-size IAM inline policies based on access advisor usage data
- periodically revoke stale IAM permissions in a multi-account AWS setup
- audit and remediate over-privileged IAM roles

## When to choose
- you manage IAM roles at scale across multiple AWS accounts
- you already run Netflix Aardvark to collect CloudTrail access advisor data
- you want automated, scheduled least-privilege remediation of inline policies

## When to avoid
- you only need one-off IAM policy audits rather than continuous remediation
- your IAM permissions are managed exclusively through customer-managed policies rather than inline policies
- you cannot deploy the Aardvark data-collection dependency or DynamoDB storage

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, cli, monitoring
- domain: security, cloud-computing
- platform: python, cloud, cli
- tags: aws-iam, least-privilege, access-advisor, aardvark, dynamodb, policy-remediation, devops, docker

## Member repositories
- Netflix/repokid (main) score 47

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:45.804304+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T06:34:05.185587+00:00, confidence not recorded.
  - readme: https://github.com/Netflix/repokid (fetched 2026-08-28T04:03:45.804304+00:00, sha 5c0de3f6aee6)
  - registry_pypi: https://pypi.org/pypi/repokid/json (fetched 2026-08-29T12:39:22.757360+00:00, sha 81ed3e4773af)
- Data as of 2026-08-30T08:39:29.467469+00:00.