diff --git a/pkgs/development/python-modules/py-iam-expand/default.nix b/pkgs/development/python-modules/py-iam-expand/default.nix
new file mode 100644
index 000000000000..4b0ee718f0d3
--- /dev/null
+++ b/pkgs/development/python-modules/py-iam-expand/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  iamdata,
+  poetry-core,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "py-iam-expand";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "prowler-cloud";
+    repo = "py-iam-expand";
+    tag = version;
+    hash = "sha256-P6PWf7qkc/8/BeRycYgvFApIaUrbhKq4h718Nrs817U=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ iamdata ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "py_iam_expand" ];
+
+  meta = {
+    description = "Module to expand and deobfuscate AWS IAM actions";
+    homepage = "https://github.com/prowler-cloud/py-iam-expand";
+    changelog = "https://github.com/prowler-cloud/py-iam-expand/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index dd68f0bbe029..e6528c889bf3 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12432,6 +12432,8 @@ self: super: with self; {
 
   py-expression-eval = callPackage ../development/python-modules/py-expression-eval { };
 
+  py-iam-expand = callPackage ../development/python-modules/py-iam-expand { };
+
   py-improv-ble-client = callPackage ../development/python-modules/py-improv-ble-client { };
 
   py-libnuma = callPackage ../development/python-modules/py-libnuma { };