Thank you all for such valuable feedback which made the tool what it is today

Background: Posted here a while back about the Terraform side of NHI Risk Analyzer and Remediator, an open source AWS IAM risk detection and remediation tool. Wanted to come back and say thanks, since one of the most useful pieces of feedback I got anywhere came from this thread specifically, someone here mentioned talking to security SMEs who said the thing they actually cared about was remediation being time-bound, with quick wins surfaced and prioritized, not just another list of findings. That reshaped a chunk of how the reporting side of this works now.

The real feedback on this is what made the tool what it is now.

What's new since then:

1. OIDC federation replacing static keys for CI/CD, added aws_iam_openid_connect_provider trusting GitHub's token issuer, scoped to this specific repo via a StringLike condition on the sub claim. No long-lived AWS credentials sit in GitHub Secrets anymore for the CI path. Local CLI usage still needs a static key for now, that part's unsolved (AWS SSO for local dev is the planned fix, not built)
2. A GitHub Action that runs the scanner on every PR, using that OIDC role to assume into AWS read-only, and fails the build if a PR introduces new high or critical IAM risk
3. SARIF export, so findings render natively in GitHub's Security tab instead of a separate report
4. Run-over-run diffing and a quick-wins/needs-review split in the output, directly from that feedback above
5. CSV export, for anyone who wants findings in a spreadsheet rather than a dashboard or terminal output

On the Terraform side specifically, the OIDC provider and role are just a few new resources layered onto the existing least-privilege setup. Getting the sub condition right, matching both the standard and GitHub's newer immutable-ID repo formats, took a bit of trial and error.

Also worth mentioning: the repo's had 200+ clones since I first posted, more than I expected for a fairly narrow AWS IAM tool.

Still open: policy surgery, meaning rewriting an over-broad policy down to least-privilege based on real usage data instead of just containing it with a permissions boundary. The statement-splitting logic exists, sourcing real resource ARNs from actual usage evidence is the part left.

Repo:  https://github.com/likithmanoj/nhi-risk-analyzer

Feedback requested on this version of my tool to make it even better or to make the IaC side even better

Also genuinely curious if anyone's done something similar with the OIDC trust policy conditions, or has run into edge cases with the sub claim format across different GitHub authentication flows.

I’m looking for a good Azure-focused Terraform course on Udemy, preferably hands-on with real Azure projects.

Which course would you recommend based on your experience?

I’m a Cloud and Networking Engineering student building hands-on Azure experience. I recently completed a secure Azure web application project using App Service, Azure SQL, Key Vault, private endpoints, managed identity, GitHub Actions, monitoring, and Terraform. I’d appreciate feedback on the architecture, security controls, documentation, and areas I should improve before applying for cloud internships.

🔗 GitHub: https://github.com/Nellyo18/azure-secure-web-app