Infrastructure / BROWSER-ONLY UTILITY
AWS IAM Policy Reviewer
An Allow statement is only one input to an AWS authorization decision. Review its scope here, then evaluate the policy where it is actually attached.
Or paste the original source text
Choose the original AWS IAM policy JSON file or paste the policy directly. No extra wrapper is needed. At most 500 statements; Terraform, Azure and Google Cloud formats are unsupported. Limit: 100,000 characters.
Loading local tool code...
Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.
Result
Technical details (optional)
Review the result before sharing. It may still contain personal or confidential information.
Breadth is different from effective permission
Wildcard actions and resources are highlighted in Allow statements. Broad Deny statements are not labelled as broad grants. Some AWS actions require Resource="*", so a wildcard is a review point rather than an automatic mistake. The checker does not maintain a catalogue of every AWS action or expand wildcard patterns into permissions.
Exclusions and principals need attachment context
Allow with NotAction or NotResource can cover much more than an initial reading suggests. Wildcard principals receive a separate trust-boundary note, even when conditions are present. NotPrincipal is also highlighted because its effects depend on context. A trust policy may legitimately omit Resource; an identity policy has different requirements.
Structure checks catch selected editing errors
The reviewer checks Effect spelling, action and resource field shapes, mutually exclusive element pairs and the policy language Version. Statement may be one object or an array. Selected role-delegation and policy-management actions receive a manual-review note, without pretending that their presence alone demonstrates privilege escalation. Statement identifiers and resource values are not repeated.
Conditions are retained as an unresolved boundary
A condition object is identified, not executed against an invented request. Explicit denies, identity and resource policies, service control policies, resource control policies, boundaries and sessions can all affect access. This page is neither the AWS policy simulator nor Access Analyzer. It does not assess a cloud account, certify least privilege or accept Azure, Google Cloud or Terraform policy syntax.
References
Documentation reviewed: . Rule results describe the supplied text, not a live application test.
Useful next steps
- Kubernetes Manifest Reviewer
- Self-Reported Security Checklist
- Security Report Builder
- Practical guides and coding projects
Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.