AWS IAM Policy Configuration Profiles Dataset for Cloud Misconfiguration Detection
Description
This dataset contains 1,000 synthetic Amazon Web Services (AWS) Identity and Access Management (IAM) policy configuration profiles designed for machine learning research on cloud security misconfiguration detection. Each profile is labeled as either compliant or misconfigured, enabling binary classification, while misconfigured samples also include multi-label vulnerability annotations for vulnerability diagnosis. Each record contains a valid AWS IAM policy (Version 2012-10-17) together with IAM context such as entity type (user or role), deployment environment, MFA status, access key age, and policy attachment type. A flattened CSV version provides 21 deterministic numeric and binary features extracted from the policy, making the dataset directly usable for conventional machine learning algorithms. The dataset is intentionally imbalanced, containing 700 compliant (70%) and 300 misconfigured (30%) policies to approximate real-world cloud environments where insecure configurations are less common. Misconfigured policies include one to three injected vulnerabilities selected from 11 common IAM security weaknesses: full administrative access, wildcard actions, wildcard resources, public principals, unrestricted iam:PassRole, privilege-escalation action sets, missing MFA on privileged operations, missing encryption enforcement, removed conditional guardrails, cross-account trust without ExternalId, and over-permissive NotAction grants. The dataset was generated using a template-based synthesis framework with controlled vulnerability injection. Secure policies follow the principle of least privilege, while misconfigured policies are created by injecting one to three vulnerabilities into compliant templates. This approach ensures realistic policy structures and accurate, noise-free ground-truth labels. The dataset includes three files: (1) a JSON file containing complete IAM policy documents and metadata for text-based or sequence-based learning, (2) a CSV file containing the flattened feature matrix for traditional ML models, and (3) a summary JSON describing class distribution, vulnerability statistics, and feature definitions. (4) a genrate_aim_dataset.py script (5) documentation of the dataset description and the dataset production process The accompanying Python generator script, implemented entirely with the Python standard library, is fully seed-controlled, allowing byte-for-byte regeneration or extension of the dataset to different sizes and class distributions. The dataset includes comprehensive documentation covering the data dictionary, generation process, vulnerability injection, and feature extraction. As all records are synthetic, no real AWS credentials or sensitive information is included, making the dataset safe for research, benchmarking, and educational use.
Files
Steps to reproduce
Requirements: Python 3.8 or later. No third-party packages are required. The generator uses only the Python standard library (json, csv, random, uuid, argparse, datetime, and collections). No internet connection, AWS account, or AWS credentials are required. Step 1 – Download the Generator: Download generate_iam_dataset.py from this dataset and place it in an empty working directory. Step 2 – Regenerate the Dataset: Run the following command: python3 generate_iam_dataset.py --n 1000 --seed 42 --compliant-ratio 0.7 The script generates three files: iam_dataset.json: Complete IAM policies, metadata, and labels. iam_dataset.csv: Flattened dataset containing 21 extracted features and labels. dataset_summary.json: Dataset statistics, class balance, and vulnerability distribution. Step 3 – Verify the Output: The generated dataset should contain 1,000 profiles, including 700 compliant and 300 misconfigured policies. Using the same random seed (42) reproduces the published dataset exactly. Dataset Generation: For each profile, the generator creates IAM context information, builds a least-privilege IAM policy, injects one to three vulnerabilities into misconfigured policies, and extracts a fixed feature set for machine learning. This approach ensures realistic policies and accurate labels. Generating Custom Datasets: Run the following command: python3 generate_iam_dataset.py --n 5000 --seed 7 --compliant-ratio 0.9 --outdir ./variant Parameters: --n: Total number of profiles. --seed: Random seed for reproducibility. --compliant-ratio: Fraction of compliant profiles. --outdir: Output directory. Using the Dataset: For traditional machine learning, use iam_dataset.csv, remove the profile_id, entity_name, and vulnerabilities columns, encode categorical features, and perform a stratified train-test split. Since the dataset is imbalanced (70% compliant and 30% misconfigured), evaluate models using Precision, Recall, and F1-score rather than accuracy alone. For text-based or policy analysis, use the raw IAM policies in iam_dataset.json. A complete data dictionary and detailed description of the dataset generation process are provided in the accompanying documentation.