AWS IAM Service Authorization Drift Monitor

Monitor the official AWS Service Authorization Reference JSON for IAM permission-surface drift: new actions, removed actions, new permission-management actions, resource type changes, condition-key changes, and count mismatches against your baseline.

This Actor is unofficial and is not affiliated with Amazon Web Services. It reads AWS public documentation endpoints only; it does not access your AWS account, credentials, policies, CloudTrail, or private resources.

What it does

AWS publishes machine-readable Service Authorization Reference files for services such as s3, lambda, bedrock, iam, ec2, and organizations. Those files define IAM actions, resource types, condition keys, and annotations such as IsWrite and IsPermissionManagement.

This Actor:

• Fetches https://servicereference.us-east-1.amazonaws.com/v1/service-list.json.
• Resolves watched services through that official list.
• Fetches each selected service JSON from the AWS-provided URL.
• Computes stable semantic hashes over actions, resources, condition keys, and key AWS annotations.
• Compares against inline baseline rows or a previous Apify dataset.
• Emits one deterministic dataset row per service plus an OUTPUT.snapshot suitable for the next scheduled run.

Repeat-use loop

Run it on a schedule against your critical AWS services. Use the previous run's dataset as baselineDataset on the next run. New IAM actions or permission-management actions can then trigger review before your SCP templates, IAM allowlists, policy generators, or least-privilege workflows drift silently.

Input

Minimum input:

{
  "services": [
    { "service": "s3", "label": "Amazon S3", "critical": true },
    { "service": "lambda", "label": "AWS Lambda", "critical": true },
    { "service": "bedrock", "label": "Amazon Bedrock", "critical": true }
  ],
  "includeUnchangedRows": true
}

To compare with a previous run, select the previous dataset with baselineDataset in the Apify UI, or pass compact rows in baselineRows.

Output rows

Each dataset row includes:

• service, sourceUrl, and source modified time from AWS.
• actionCount, writeActionCount, permissionManagementActionCount, resourceTypeCount, and conditionKeyCount.
• semanticHash and previousSemanticHash.
• newActionNames, removedActionNames, and newPermissionManagementActionNames when the baseline contains action names.
• alert, priority, riskScore, alertReasons, and recommendedAction.

Limitations

• This is a public-reference drift monitor, not an AWS account audit.
• AWS notes that service reference information changes can take up to 24 hours to be reflected.
• Added/removed action names require a previous row that includes actionNames; otherwise the Actor still detects semantic/count drift.
• It does not fetch arbitrary user-provided URLs. Service JSON URLs are resolved from AWS service-list.json only.

Pricing

from $2.00 / 1,000 AWS IAM service authorization drift rows

This Actor uses Apify Pay per Event pricing with platform usage included. The row event is charged only for useful rows written to the default dataset.

Event	Price	Unit
Actor start (apify-actor-start)	$0.00005	Once when the run starts.
AWS IAM authorization drift row (apify-default-dataset-item)	$0.002	Per AWS IAM service authorization drift row.

A row is one AWS service/action authorization drift row. Apify plan discounts, user-configured max-charge limits, and any future Apify pricing UI changes may affect final charges.

Related Actors in this portfolio

This Actor is part of the Cloud platform drift monitors group. These are narrow, source-specific Apify Actors intended for scheduled checks and repeatable dataset exports — not broad scraped-content feeds.

• FedRAMP Marketplace Authorization Monitor — FedRAMP Marketplace authorization/status monitoring for vendor-risk workflows.
• AWS IAM Service Authorization Drift Monitor — AWS IAM Service Authorization Reference drift checks for cloud-security reviews.
• CloudFormation Resource Spec Drift Monitor — CloudFormation resource-spec drift checks for replacement-risk and required-property changes.

Each listing includes its own source notes, limits, pricing, and responsible-use caveats. Use the official source links in each Actor when decisions require verification.