DevOps

AWS IAM Policy Generator

Scaffold secure AWS IAM JSON policies visually. Apply quick templates for S3, Lambda, and DynamoDB while auditing against overly permissive wildcard permissions.

Quick Policy Templates
#1
arn:aws:s3:::my-bucket/*

Least Privilege Verified

Policy statements are explicitly scoped to designated AWS actions and Resource ARNs.

Generated IAM Policy JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3Access",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

Complete Guide to Generating Secure AWS IAM JSON Policies

Managing **Amazon Web Services (AWS) Identity and Access Management (IAM)** policies by hand is one of the most error-prone tasks in cloud infrastructure. Misconfigured JSON syntax or accidental wildcard permissions (`"Action": "*"`) can inadvertently expose sensitive data or grant full administrative privileges across an AWS account.

Our client-side **AWS IAM Policy Generator** provides a visual, zero-tracking environment to generate structured JSON policies for your IAM roles, users, and groups while actively auditing your policy against the **Principle of Least Privilege**.

1. S3 Bucket Read-Only vs. Read/Write Policy Patterns

When configuring access to Amazon Simple Storage Service (S3), developers often forget that listing bucket contents (`s3:ListBucket`) applies to the bucket root ARN (`arn:aws:s3:::my-bucket`), whereas reading or uploading files (`s3:GetObject`, `s3:PutObject`) applies to object paths (`arn:aws:s3:::my-bucket/*`).

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3ReadAccess",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}

2. Lambda Execution Roles & CloudWatch Logging

Every AWS Lambda execution role requires baseline permissions to write diagnostic logs to Amazon CloudWatch. Without `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents`, your serverless functions will fail silently without observable execution history.

3. DynamoDB Least-Privilege CRUD Table Policies

To allow an application server or Lambda function to interact with Amazon DynamoDB without granting full table deletion rights (`dynamodb:DeleteTable`), scope your statements strictly to item-level operations (`dynamodb:GetItem`, `dynamodb:PutItem`, `dynamodb:UpdateItem`, `dynamodb:Query`) and target your specific table ARN.

Service-Specific IAM Policy Generators

Need a policy tailored to a specific AWS service? Use one of our dedicated generators with pre-configured actions and Resource ARN patterns:

S3 Bucket IAM Policy GeneratorLambda IAM Policy GeneratorDynamoDB IAM Policy GeneratorEC2 IAM Policy Generator

How to Use

  1. 1

    Choose Preset or Service

    Select a quick template (e.g. S3 Read/Write) or pick an AWS service from the dropdown.

  2. 2

    Select Allowed Actions

    Click action tags (like s3:GetObject or dynamodb:Query) or type custom AWS actions.

  3. 3

    Specify Resource ARNs

    Enter the exact Amazon Resource Names (ARNs) to enforce least privilege.

  4. 4

    Verify & Copy

    Check the real-time security audit badge and copy the formatted JSON policy.

Frequently Asked Questions

How do I generate an AWS S3 bucket read-only IAM policy in JSON?+

To grant read-only access to an Amazon S3 bucket, specify Effect as 'Allow', set Actions to ['s3:GetObject', 's3:ListBucket'], and specify both your bucket root ARN ('arn:aws:s3:::bucket-name') and object path ARN ('arn:aws:s3:::bucket-name/*'). You can select our 'S3 Read-Only Access' preset to generate this exact JSON instantly.

What is the principle of least privilege in AWS IAM?+

The principle of least privilege dictates granting only the precise permissions required to perform a task. In AWS IAM, this means avoiding wildcard Actions ('*') and restricting Resource ARNs to specific S3 buckets, DynamoDB tables, or Lambda functions rather than account-wide wildcards.

What IAM permissions does an AWS Lambda function need for CloudWatch Logs?+

A standard Lambda execution role requires permission to write logs to Amazon CloudWatch. The necessary IAM actions are 'logs:CreateLogGroup', 'logs:CreateLogStream', and 'logs:PutLogEvents' scoped to your CloudWatch log group Resource ARN.

How do I grant DynamoDB table read and write permissions?+

For CRUD operations on an Amazon DynamoDB table, include actions for 'dynamodb:GetItem', 'dynamodb:PutItem', 'dynamodb:UpdateItem', 'dynamodb:DeleteItem', and 'dynamodb:Query' scoped explicitly to your target DynamoDB table ARN.

Does this IAM policy generator send my AWS resource ARNs to external servers?+

No. Toolforge processes 100% of your policy scaffolding directly inside your browser using client-side JavaScript. Your internal bucket names, Lambda ARNs, and AWS architecture details never leave your device.