Thanks for sharing the source, I've also parsed IAM policies with Go and it requires some thought. Your solution is nicer to look at I think. I worked with a guy whose basic philosophy was whatever AWS recommends do the exact opposite and his IAM policies are rats nest of denies and nots. It is usually easier to rewrite them than debug them - looking to see if this might ease the burden.