IAM Policy Analyzer | AWS Policy Risk Check

Analyze an AWS IAM policy for wildcard actions, open resources and missing conditions. Flags least-privilege risks before a SOC 2 review. Free. Designed specifically for developers and professionals, this free online analyzer runs entirely in your browser to process tasks quickly and securely. Enjoy unlimited usage with no data tracking and no registration required.

Also known as: iam policy analyzer · aws iam policy checker online · iam least privilege checker · check iam policy wildcards · aws policy risk analyzer · iam policy validator online · analyze iam json policy · iam policy security review

devops and infrastructure tools

json tools

analyzers

IAM Policy JSON

Risk Findings

Findings will appear here, ranked by risk, with the statement Sid that produced each one.

About IAM Policy Analyzer

IAM Policy Analyzer reads an AWS IAM policy document and reports where it grants more access than it should. Paste the JSON and it flags wildcard actions, Resource set to star, NotAction and NotResource used with Allow, privilege-escalation actions such as iam:PassRole, and wildcard statements with no Condition block. Each finding names the statement Sid that caused it.

Key Features

Flags the full-admin combination of Action "*" with Resource "*" as a critical finding
Detects service-wide wildcards such as s3:* and names the operations to replace them
Identifies privilege-escalation actions including iam:PassRole, sts:AssumeRole and iam:CreatePolicyVersion
Warns when NotAction or NotResource is paired with Effect Allow, which inverts the grant
Catches a Principal of "*" on resource policies that would expose them to any AWS account
Scores the document 0 to 100 so two revisions of the same policy can be compared

Use Cases

Review a deployment role before it ships to a us-east-1 production account
Check a Terraform-generated policy for wildcards the module author left in
Collect least-privilege evidence ahead of a SOC 2 Type 2 access-control review
Screen a vendor-supplied cross-account role before trusting it with your account
Teach a new engineer why Resource star is the finding auditors always open with
Compare a tightened policy against the original and confirm the score moved

Supported Formats

IAM identity policies

IAM resource policies

S3 bucket policies

Trust policies (AssumeRole)

Related Keywords

iam policy analyzer

aws iam policy checker online

iam least privilege checker

check iam policy wildcards

aws policy risk analyzer

iam policy validator online

analyze iam json policy

iam policy security review

Does a wildcard in an IAM policy always mean it is insecure?

No, and treating every star as a failure is how teams learn to ignore the warnings. A read-only policy scoped to one bucket with Resource "arn:aws:s3:::reports/*" uses a wildcard correctly, because the prefix still bounds it. The finding that matters is an unbounded one: Action or Resource set to a bare "*", a service-wide grant like s3:*, or any wildcard with no Condition narrowing it by source IP, org ID or tag. This tool ranks those separately for that reason.

Privacy & Security

All processing happens locally in your browser. Your data never leaves your computer, ensuring complete privacy and security.

Liked this tool?

DevToolLab is free to use. If this analyzer saved you some time today, please consider supporting our work.

Buy us a coffee ☕

Frequently asked questions

What is IAM Policy Analyzer used for?

Analyze an AWS IAM policy for wildcard actions, open resources and missing conditions. Flags least-privilege risks before a SOC 2 review. Free.

Is IAM Policy Analyzer free to use?

Yes. IAM Policy Analyzer is completely free with no usage limits, and there is no paid tier required to use it.

Do I need an account to use IAM Policy Analyzer?

No. IAM Policy Analyzer works immediately in your browser with no signup, login, or email address required.

Related Tools

Word & Character Counter Online | Word Counter

Count words, characters, sentences, paragraphs and lines in your text. Analyze letter density and reading time instantly.

text tools

date and time tools

URL Parser | URL Analyzer Online

URL parser - extract protocol, host, path, query parameters, and hash fragments. Free, no signup, works instantly online.

hashing and checksum tools

url and link tools

User Agent Parser | Analyze Browser & OS Online Free

Parse and analyze user agent strings to detect browser, operating system, device type, and bot information. Essential for web debugging.

text tools

code formatters and minifiers

More Tools You Might Like

Pastebin Online | Share Code & Text Snippets Free

Popular

Share code snippets, logs, and text with a shareable link. Syntax highlighting for 30+ languages, expiration controls, and password protection for Pro users.

text tools

password and key generators

math calculators

utilities

Use Tool

URL Tracker & Link Shortener | Track Clicks

Popular

Create short, trackable URLs with detailed click analytics. Track visitor location, devices, referrers, and more. Password protection & QR codes included.

text tools

password and key generators

url and link tools

networking

Use Tool

Webhook Receiver & Inspector | Test HTTP Webhooks

Popular

Generate a unique URL to easily test, receive and inspect HTTP webhooks in real-time. View request headers, query parameters, JSON payloads, and more.