awslabs/iam-policy-autopilot 0.2.4-rc.1 on GitHub

generate-policies can now generate an IAM policy directly from a Terraform plan (terraform show -json), mapping the plan's resource changes to the AWS SDK operations the Terraform AWS provider performs. Pass the plan JSON in place of source files.
Support for chained and nested boto3 sub-resource actions, including calls on a variable bound to a chain — e.g. s3.Bucket("b").put_object(...), s3.Bucket("b").Object("k").put(...), and obj = s3.Bucket("b").Object("k"); obj.put(...) now resolve to the underlying operation with identifiers injected from the chain
Warnings field in the generate-policies output flagging statements whose Resource fell back to the "*" wildcard (no ARN patterns available, an empty resource list, or the resource list was collapsed by the resource cutoff). Each warning carries a machine-recognizable WarningType plus policy and statement indices locating the flagged statement, so callers can construct their own review messages
New telemetry result metrics for generation runs: num_statements_generated, num_actions_generated, and num_wildcard_resource_statements (counts only, no policy content). See TELEMETRY.md

An unrecognized method on a known boto3 resource no longer expands to every action of that resource. Such calls now contribute no permissions instead of over-approximating
Generated policy statements are now sorted globally by service before being assigned to policies, so statements for the same service stay together (within size limits), producing deterministic, review-friendly output and stable diffs. Note: when cross-service action merging is enabled (--minimize-policy-size / allow_cross_service_merging = true), statements are grouped by shared resource rather than by service, so a single service's actions may be merged into a statement keyed on another service and the "same service stays together" grouping does not hold. This is expected for that option, which exists to produce more compact policies; the sort remains deterministic. (#153)

cloudwatch:PutMetricData no longer scopes to dataset/* resources — the AWS service reference added dataset as a resource type, but regular custom metric publishing requires Resource: "*"