feat: add AI-powered policy generation command

[reaandrew]

Summary

• Add new generate command that creates security-focused IAM policies from AWS service authorization documentation using LLM APIs
• Scrapes IAM actions, condition keys, and resource types automatically from AWS docs
• Supports parallel batch processing with configurable concurrency for faster generation
• Includes custom prompt support for specifying security requirements
• Implements 24-hour caching of AWS documentation pages
• Generates comprehensive output: policy JSON, IAM reference data, and human-readable documentation

Features

• Automatic scraping of IAM data from AWS service authorization pages
• Parallel LLM requests with configurable concurrency (default: 3)
• Custom prompts via --prompt flag for specific security requirements
• Retry logic with exponential backoff for API failures (5 attempts)
• 24-hour caching in ~/.cache/politest/ to reduce API calls
• Three output files:
  • {service}-iam-reference.json - Scraped IAM data
  • {service}-full-access-policy.json - Generated policy with security conditions
  • {service}-policy-documentation.md - Documentation explaining each statement
• Consistent placeholder variables (${AWS::AccountId}, ${VpcEndpointId}, etc.)
• Progress bar using schollz/progressbar library

Usage Example

./politest generate \
  --url "https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html" \
  --base-url "https://your-llm-api.example.com/api" \
  --model "claude-3-sonnet" \
  --api-key "$LLM_API_KEY" \
  --output "./output" \
  --concurrency 4 \
  --prompt "Require VPC endpoint conditions where supported."

Test plan

• Build compiles successfully
• Generate command produces all three output files
• Parallel processing works with configurable concurrency
• Custom prompts are incorporated into policy generation
• Caching works for subsequent runs
• Retry logic handles API timeouts (HTTP 5xx)
• README documentation updated

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate failed

Failed conditions
79.2% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud