Analyze AWS IAM policies for wildcard permissions, overly broad access, potentially risky actions, and common policy configuration issues.
Paste an AWS IAM policy or open an existing JSON policy file.
Your support helps us build more tools and improve the ones you already use.
More tools you may find useful.
Parse AWS Amazon Resource Names and inspect their partition, service, region, account ID, resource type, and resource name components.
Analyze Docker Compose files for services, images, builds, ports, volumes, networks, dependencies, environment variables, and common container configuration issues.
Analyze Dockerfiles for base images, build stages, instructions, ports, users, environment variables, caching opportunities, and common containerization issues.
Analyze Kubernetes manifests to inspect resources, workloads, replicas, containers, images, labels, selectors, references, and common configuration issues.
AWS IAM Policy Analyzer is a browser-based tool for reviewing AWS Identity and Access Management policy documents. It parses IAM JSON policies, summarizes their statements, and highlights potentially broad permissions, wildcard actions, wildcard resources, principals, and other patterns that deserve security review.
An AWS IAM policy is a JSON document that defines permissions for interacting with AWS resources. Policy statements can allow or deny actions and can use resources, principals, conditions, and other policy elements to control access.
IAM policies are an important part of AWS security because overly broad permissions can increase the impact of compromised credentials or incorrectly configured identities.
This analyzer performs static analysis of the policy document and identifies several common permission patterns that may require review.
Wildcard permissions can be useful in carefully controlled situations, but they can also grant significantly more access than an identity actually requires.
An Action of * can allow every IAM action available to the applicable principal. A service-level wildcard such as s3:* can allow all actions within a service.
Similarly, Resource: * can apply permissions to every applicable resource rather than a specific bucket, object, queue, function, or other resource.
Findings are categorized as high, medium, low, or informational. The severity indicates how important a pattern may be to review, not whether the permission is automatically exploitable or incorrect.
A broad permission may be intentional for an administrative role, automation identity, deployment system, or other trusted workload. Always evaluate findings within the context of the identity and workload using the policy.
The principle of least privilege recommends granting only the permissions required for a workload or user to perform its intended tasks.
Where practical, replace broad actions with specific actions and replace Resource: * with the smallest appropriate set of resources. Conditions can also help restrict when or how a permission can be used.
IAM policy behavior is not determined by a single policy document in isolation. Conditions, identity policies, resource policies, permissions boundaries, service control policies, session policies, and other AWS authorization mechanisms can affect the final authorization decision.
For this reason, a finding from this tool should be treated as a review signal rather than a definitive statement that an AWS permission is exploitable.
This tool analyzes the JSON policy structure and common permission patterns. It does not contact AWS, evaluate a live IAM environment, resolve every AWS service action, or calculate the complete effective permissions of an identity.
A policy can be syntactically valid and still be inappropriate for a particular workload. Conversely, a broad-looking permission can be intentional in a controlled environment.
IAM policies can contain account IDs, resource ARNs, role names, principals, conditions, and other infrastructure information. Treat policy documents according to your organization's security requirements.
ToolTunnel performs this analysis locally in your browser. The policy does not need to be uploaded to a ToolTunnel backend.
An IAM policy is a JSON document that defines permissions for AWS resources and identities using statements containing elements such as Effect, Action, Resource, Principal, and Condition.
No. The analyzer performs static analysis locally in your browser and does not need to query AWS APIs.
Not necessarily. A high finding indicates a potentially important pattern that should be reviewed. Whether the permission is appropriate depends on the identity, workload, and surrounding AWS authorization controls.
Action: * can grant every applicable IAM action, which can be significantly broader than the permissions required by a workload or user.
Resource: * can make a permission apply to all applicable resources instead of restricting it to specific resources. Whether this is acceptable depends on the AWS service and use case.
A wildcard principal can allow access to a broad set of principals and should be reviewed carefully, especially when used with Allow statements.
No. It analyzes one policy document and common patterns. Effective permissions can depend on identity policies, resource policies, SCPs, permissions boundaries, session policies, conditions, and other controls.
No. The analyzer is designed to process the policy locally in your browser without uploading it to a ToolTunnel backend.