v0.9.2

What's Changed

• fix: iam:RemoveRoleFromInstanceProfile false positive on aws_iam_role delete by @elecnix in #152
• release: bump to v0.9.2 by @elecnix in #153

Full Changelog: v0.9.1...v0.9.2

v0.9.1

What's Changed

• feat(iam): require iam:CreateServiceLinkedRole for resources that make a service create its role by @elecnix in #136
• release: bump to v0.9.1 by @elecnix in #139

Full Changelog: v0.9.0...v0.9.1

v0.9.0

What's Changed

• ci: add/upgrade cite review to v0.4.0 by @elecnix in #57
• ci: add cite code review action (v0.5.0) by @elecnix in #59
• ci: move CI workflow back to GitHub-hosted runners by @elecnix in #60
• ci: bump cite code review action to v0.8.0 by @elecnix in #61
• ci: bump the Cite review action to v0.10.0 by @elecnix in #62
• Review with Ollama Cloud by default by @elecnix in #63
• fix: report resource-scoped grants that don't cover the target ARN by @elecnix in #65
• fix(provideraws): map eventbridge SDK package to events IAM prefix by @elecnix in #58
• Let an exclude entry name the operations it covers by @elecnix in #83
• Static mode: validate all mutation operations (create, update, delete) by @elecnix in #38
• refactor(hcl): parse the .tf tree once — MapResources becomes a projection over ParseDir by @elecnix in #71
• refactor(provideraws): one AST traversal with two observers by @elecnix in #74
• Treat d.HasChange as a gate, so an unchanged attribute drops its SDK call by @elecnix in #84
• fix(provideraws): map the S3 encryption SDK methods to their IAM actions by @elecnix in #86
• ci: check PR body formatting by @elecnix in #89
• Stop reporting a value-guarded delete call as required by @elecnix in #85
• feat: match SQS queue and iam:PassRole grants against the target ARN by @elecnix in #93
• fix(provideraws): lock and version the provider source cache by @elecnix in #98
• fix(iam): match S3 optional actions and absorption to the names S3 emits by @elecnix in #99
• fix(provideraws): parse closures and helpers, fall back when incomplete by @elecnix in #100
• fix(provideraws): generate IAM names from the AWS service reference by @elecnix in #101
• fix(iam): evaluate Deny, NotAction, NotResource, Condition and globs by @elecnix in #102
• feat: add --strict-resources for grants on an underivable target by @elecnix in #103
• fix(provideraws): report API Gateway HTTP verbs and Logs stream gaps by @elecnix in #104
• refactor(check): run the validate pipeline through one Check module by @elecnix in #105
• refactor(iam): one requirement type behind one schema interface by @elecnix in #106
• refactor(iam): decide coverage in one place by @elecnix in #107
• refactor(iam): decide class and S3 absorption from one rule table by @elecnix in #108
• feat: check declared principal needs against the policy by @elecnix in #109
• refactor(report): group, locate and render findings in one module by @elecnix in #110
• feat(permdata): embed the provider-source permissions table by @elecnix in #111
• feat(provideraws): read Terraform Plugin Framework resources by @elecnix in #112
• fix(iam): report resource types no schema source knows by @elecnix in #113
• refactor: remove dead and test-only internal API by @elecnix in #114
• fix(iam): correct pass verdicts for resources, gates, targets and Deny by @elecnix in #121
• fix(provideraws): gate each if branch on what its own outcome implies by @elecnix in #122
• fix(plan): read plan actions and module addresses as terraform does by @elecnix in #123
• refactor(iam): run every finding through one pipeline and rule table by @elecnix in #126
• refactor(provideraws): return iam.Requirement from the parser walker by @elecnix in #127
• refactor: extract the policy package and fix two false negatives by @elecnix in #128
• feat: publish as a GitHub Action and build release binaries by @elecnix in #115
• fix: make the build, CLI, action and CI ready for production use by @elecnix in #124
• release: bump to v0.9.0 by @elecnix in #116
• fix(iam): require optional features the plan uses, plus four review fixes by @elecnix in #130
• ci: bump the Cite review action to v0.14.0 by @elecnix in #133
• ci: bump GitHub Actions to their latest releases by @elecnix in #134
• ci: bump cite to v0.15.0 by @elecnix in #135

Full Changelog: v0.8.1...v0.9.0

v0.8.1 — git clone stderr no longer leaks into tool output

What's changed

• The AWS provider source clone no longer leaks git stderr into the tool's output (#53). The shallow clone that pulls terraform-provider-aws source now buffers git's stderr instead of streaming it through the tool's stdout, so checkout-progress messages and detached-HEAD / annotated-tag warnings from the clone no longer appear in what the tool prints. Reviewers and CI logs see only the tool's own findings. Fixes the noise reported when running against annotated tags or detached HEADs.

Full changelog: v0.8.0...v0.8.1

v0.8.0 — delete conditionals evaluated against before-state

What's changed

• Plan mode: conditional permissions on delete changes are now evaluated against change.before (#50, fixes #49). Previously, delete changes carried a nil attribute-presence map (only change.after was read, which is null on deletes), so [conditional: attr] permissions were always reported as missing for destroys — even when the gating attribute was never set. Deletes now read prior state, matching the provider's d.GetOk-at-destroy semantics. Known residual: computed attributes (e.g. version_stages storing ["AWSCURRENT"]) still read as set in prior state, and value-level guards inside the provider are invisible to static analysis — use the exclude-config for those.
• CI: TestVersionCommand no longer drifts on release bumps (#51). The version is now a single constant referenced by both the version subcommand and the test.

Full changelog: v0.7.0...v0.8.0

v0.6.0 — exclude-config support

New

• permcheck.json exclude-config — suppress known-false-positive permission gaps via a JSON config file. Auto-discovered at ./permcheck.json in the working directory; override with --config <path>.
• --show-excluded flag — surface suppressed gaps as ::notice:: annotations in --format github-annotations, as an excluded array in --format json, and as an Excluded (per config) block in text output.
• --exit-zero flag — exit 0 even when permission gaps are found, useful for non-blocking CI gates.

Config schema

{
  "exclude": [
    {
      "permission": "s3:DeleteBucketPublicAccessBlock",
      "resource": "aws_s3_bucket_public_access_block.*",
      "reason": "bucket has Object Lock — delete is intentionally blocked"
    }
  ]
}

Field	Required	Description
permission	yes	IAM action, glob-capable (s3:*)
resource	optional	Terraform type or type.name pattern, glob-capable, index-stripped
reason	optional	Audit-trail note for why the gap is excluded

Behavior

• Excluded gaps are dropped from the report and no longer fail the run (exit 0 if they were the only gaps).
• --show-excluded lists them for audit-trail visibility.
• Config auto-discovered from ./permcheck.json; explicit --config <path> is fatal on load failure.

Upgrading

go install github.com/elecnix/terraform-permcheck@v0.6.0

v0.4.0 — file= and line= in github-annotations output

What's Changed

• feat: add file= and line= to --format github-annotations output by @elecnix in #32

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• feat: add --format github-annotations and --exit-zero flags by @elecnix in #30

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• fix: align documented command name with installed binary by @elecnix in #22
• fix: extract listTags SDK actions from tags_gen.go for @tags resources (#23) by @elecnix in #24
• feat: group missing permissions by action in report output by @elecnix in #25
• fix: conditional helper propagation and SDK method normalization (#27, #26) by @elecnix in #28
• feat: static HCL mode, conditional output, and --only-required flag (#19, #3, #5) by @elecnix in #29

Full Changelog: v0.1.0...v0.2.0

v0.1.0

What's Changed

• feat: parse terraform-provider-aws source to extract exact IAM permissions by @elecnix in #2
• feat: add classification tag to missing permission output by @elecnix in #11
• feat: parse @SDKResource annotation for correct terraform resource type by @elecnix in #15
• feat: filter S3 sub-resource permissions to avoid duplicate warnings by @elecnix in #13
• feat: distinguish unconditional vs conditional SDK calls in provider parser by @elecnix in #12
• feat: follow helper function calls to extract wrapped SDK API calls (rebase) by @elecnix in #16
• feat: read IAM policy from plan/state outputs by @elecnix in #18
• feat: detect provider side-effect tag permissions gated on attributes (#20) by @elecnix in #21

New Contributors

• @elecnix made their first contribution in #2

Full Changelog: https://github.com/elecnix/terraform-permcheck/commits/v0.1.0