0.2.4-rc.1

Added

• generate-policies can now generate an IAM policy directly from a Terraform plan (terraform show -json), mapping the plan's resource changes to the AWS SDK operations the Terraform AWS provider performs. Pass the plan JSON in place of source files.
• Support for chained and nested boto3 sub-resource actions, including calls on a variable bound to a chain — e.g. s3.Bucket("b").put_object(...), s3.Bucket("b").Object("k").put(...), and obj = s3.Bucket("b").Object("k"); obj.put(...) now resolve to the underlying operation with identifiers injected from the chain
• Warnings field in the generate-policies output flagging statements whose Resource fell back to the "*" wildcard (no ARN patterns available, an empty resource list, or the resource list was collapsed by the resource cutoff). Each warning carries a machine-recognizable WarningType plus policy and statement indices locating the flagged statement, so callers can construct their own review messages
• New telemetry result metrics for generation runs: num_statements_generated, num_actions_generated, and num_wildcard_resource_statements (counts only, no policy content). See TELEMETRY.md

Changed

• An unrecognized method on a known boto3 resource no longer expands to every action of that resource. Such calls now contribute no permissions instead of over-approximating
• Generated policy statements are now sorted globally by service before being assigned to policies, so statements for the same service stay together (within size limits), producing deterministic, review-friendly output and stable diffs. Note: when cross-service action merging is enabled (--minimize-policy-size / allow_cross_service_merging = true), statements are grouped by shared resource rather than by service, so a single service's actions may be merged into a statement keyed on another service and the "same service stays together" grouping does not hold. This is expected for that option, which exists to produce more compact policies; the sort remains deterministic. (#153)

Fixed

• cloudwatch:PutMetricData no longer scopes to dataset/* resources — the AWS service reference added dataset as a resource type, but regular custom metric publishing requires Resource: "*"