AWS IAM Policy Validator
Paste an IAM policy JSON to instantly flag wildcards, privilege escalation, NotAction traps, public principals, and check size limits. Everything runs in your browser — no data is sent to any server.
1
Statements
1
Actions
1
Resources
Findings (3)
Size limits: Managed policies: 6,144 chars. Inline: user 5,120, group 10,240, role 10,240.
This tool performs static analysis only. It does not check whether resources actually exist or whether actions are valid.
What This IAM Policy Checker Catches
Wildcard permissions
"Action": "*" grants every AWS action and "Resource": "*" applies it to every resource. Combined in an Allow statement this is effectively administrator access — the single most common finding in real-world IAM audits.
Privilege escalation actions
Actions like iam:PassRole, iam:CreatePolicy, lambda:CreateFunction, and cloudformation:CreateStack can let a limited principal grant itself broader permissions through resources it controls.
NotAction / NotResource traps
NotAction grants everything except the listed actions — an allow-list in disguise that grows silently as AWS releases new APIs. It is almost always safer to enumerate allowed actions explicitly.
Public principals
A Principal containing "*" in a resource-based policy opens access to anyone on the internet. Legitimate for a handful of cases (public S3 websites), dangerous almost everywhere else.
Frequently Asked Questions
Is it safe to paste my IAM policy into this checker?
Yes. All analysis runs entirely in your browser — the policy JSON is never sent to a server or stored anywhere. You can verify this in your browser's network tab.
How does this compare to AWS Access Analyzer?
AWS IAM Access Analyzer validates policies against the IAM grammar and AWS best-practice rules inside your account. This tool is a quick client-side check you can run without logging into AWS — useful for reviewing policies in pull requests, docs, or third-party templates before deployment.
What size limits apply to IAM policies?
Managed policies are limited to 6,144 characters; inline policies to 5,120 for users and 10,240 for groups and roles. If your policy is over the limit, split it into multiple managed policies or move statements into separate inline policies.
Does a clean result mean my policy is safe?
No — this is static analysis, not a security guarantee. It catches common structural misconfigurations but cannot evaluate your actual risk, which depends on which principals hold the policy, resource sensitivity, and conditions. For a full audit use tools like Cloudsplaining, Parliament, or Access Analyzer's unused-access findings.