AWS IAM Policy Generator
Generate an IAM policy JSON document with selectable Effect, Actions, Resources, and optional Conditions.
Select an effect, actions, and resource ARN - this tool generates valid IAM policy JSON, warning if your selections are unusually broad.
Syntactically valid JSON does not mean a policy follows least-privilege best practice - always review the actual permissions granted, not just whether the JSON parses.
What Is an IAM Policy?
An IAM policy is a JSON document that defines what actions are allowed or denied on which AWS resources - attached to IAM users, groups, or roles to control their permissions.
Why Use This Tool?
IAM policy JSON has precise required structure (Version, a Statement array, each with Effect/Action/Resource, and optionally Principal/Condition) - a missing bracket or wrong key name causes AWS to reject the whole policy. This tool generates valid structure from your selections.
How to Use It
- Choose Allow or Deny.
- Select one or more IAM actions (e.g.
s3:GetObject,ec2:DescribeInstances). - Enter the Resource ARN (or use
*for all resources, with the warning that implies). - Optionally add a Condition.
- Copy the generated policy JSON.
Important Notes
A policy is never claimed to be "secure" or "production-ready" just because it's valid JSON - this tool flags obviously broad grants (like Action or Resource set to *) so you can consciously decide whether that's actually intended.