DevOps

AWS IAM Policy Generator

Scaffold secure AWS IAM JSON policies visually. Apply quick templates for S3, Lambda, and DynamoDB while auditing against overly permissive wildcard permissions.

Quick Policy Templates
#1
arn:aws:s3:::my-bucket
arn:aws:s3:::my-bucket/*

Least Privilege Verified

Policy statements are explicitly scoped to designated AWS actions and Resource ARNs.

Generated IAM Policy JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadWrite",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

How to Use

  1. 1

    Choose Preset or Service

    Select a quick template (e.g. S3 Read/Write) or pick an AWS service from the dropdown.

  2. 2

    Select Allowed Actions

    Click action tags (like s3:GetObject or dynamodb:Query) or type custom AWS actions.

  3. 3

    Specify Resource ARNs

    Enter the exact Amazon Resource Names (ARNs) to enforce least privilege.

  4. 4

    Verify & Copy

    Check the real-time security audit badge and copy the formatted JSON policy.

Frequently Asked Questions

What is an AWS IAM Policy?+

An AWS Identity and Access Management (IAM) policy is a JSON document that defines what actions are allowed or denied on specific AWS resources.

Why should I avoid using '*' in Resource ARNs?+

Using '*' allows an IAM role or user to perform actions across every resource in your AWS account. Best security practice (Principle of Least Privilege) requires restricting ARNs to specific S3 buckets, DynamoDB tables, or Lambda functions.

Does this tool send my Resource ARNs or policies to a server?+

No. All policy generation and JSON formatting runs 100% locally in your web browser. Your resource ARNs and architecture details never leave your device.