AWS IAM Policy Analyzer
Paste an AWS IAM policy JSON to check for wildcard resources, overly broad actions, and full admin access. Deny-by-default review with least-privilege guidance — free, local, no signup.
How to Use the AWS IAM Policy Analyzer
Similar Tools You Might Need
See allValidator
Basic syntax sanity check for JSON (full parse), XML (root-element check), and YAML (real js-yaml parse) — JavaScript not included. Code never leaves your device.
Cookie Parser & Analyzer
Parse Set-Cookie headers into structured JSON, or analyze cookie security flags (Secure, HttpOnly, SameSite, expiry). Flag missing Secure, HttpOnly, and SameSite attributes — free, local, no signup.
Base64 to JSON Decoder
Decode Base64 strings and pretty-print JSON data — paste encoded text to see the decoded result instantly. Inspect API payloads and tokens readably — free, local, no signup.
Image Colorizer
Tint any photo with an HSL color wash — hue 0–360° (default 200° blue), saturation 0–100% (default 60), brightness −40–40% (default 10) — painted in hue-blend mode over the full-resolution image. Exports JPEG at quality 0.9 as colorized_photo.jpg; nothing uploads.
Bulk SVG to PNG
Rasterize SVG vectors to crisp PNGs at 1x, 2x (default), 3x, or 4x scale — base size read from the SVG width/height attributes (100px fallback) — with filename preservation (.svg becomes .png). Developers ship full icon sets in four runs — local Canvas work, 2 free batches a day.
Frequently Asked Questions
What security issues does it detect?
It flags wildcard resources (Resource: *), overly broad actions (Action: *), full admin access (AdministratorAccess), and policies that grant access to sensitive services like IAM, STS, or Organizations without restrictions.
What format should the policy be in?
Paste the IAM policy as valid JSON. This can be an inline policy, an attached managed policy, or the policy document from the AWS IAM console.
Does it check for SCP or permission boundary issues?
The analyzer focuses on IAM policy content — wildcard detection, action breadth, and resource scope. For SCP and permission boundary analysis, use the AWS Policy Simulator.
Can it fix the policy for me?
No. It identifies issues and provides recommendations. You must manually edit the policy in the AWS IAM console or via CLI to apply the suggested fixes.
Is my policy data stored or transmitted?
No. All analysis runs locally in your browser. Your IAM policy JSON is never sent to any server.
Related Developer Tools
Secret Scanner
Scan text and code for leaked secrets and credentials. Detects Stripe keys, GitHub tokens, Slack tokens, Google API keys, AWS keys, OpenAI keys, JWT tokens, private keys, and config passwords.
CVE Lookup
Look up CVE vulnerabilities by ID with severity, descriptions, and affected products. Check CVE-2024-3094 before patching decisions — live OSV data, free, no signup.
Last updated October 2026