IAM Policy Generator

What this tool does

Builds a single-statement IAM policy document from plain fields instead of hand-typed JSON — pick an effect, list the actions and resources, optionally add conditions, and copy the result. The output follows the current 2012-10-17 policy language.

Notes on the fields

• Actions and resources accept one entry per line (or comma-separated) — a single entry is written as a plain string in the output, multiple entries become a JSON array, matching how AWS itself writes both forms.
• Conditions are optional. Each row needs an operator, a condition key (like aws:SourceIp or aws:PrincipalTag/team), and a value. Rows sharing the same operator are merged into one Condition block, matching how AWS represents multiple keys under a single operator.
• This generates one statement. For a policy with more than one statement — say, a read-only block and a separate deny block — build each one here and combine them into a single Statement array by hand.

FAQ

Should Resource just be "*" to keep things simple?

Only while you're still figuring out what a workload actually needs — scoping it down to the specific ARN(s) involved is most of what Least Privilege Explained is about, and it's the single biggest factor in how much damage a leaked credential can do.

How do I know what to put in Actions?

Actions follow a service:ActionName format, like s3:GetObject or ec2:DescribeInstances — check the specific service's page in the Service Authorization Reference for the exact list.

What format do Resources need to be in?

A full ARN, like arn:aws:s3:::my-bucket/*, or * for every resource. See What Is an ARN? for the format breakdown, or paste an existing ARN into ARN Parser to check it.

Can I check a policy I already have instead of building one?

Yes — paste it into IAM Policy Viewer for a plain-English breakdown of each statement and a check for common structural mistakes.

Why isn't there a field for Principal?

Principal only applies to resource-based policies (like an S3 bucket policy or an IAM role trust policy) — it's not valid in a policy attached directly to a user, group, or role, which is what this tool is scoped to. If you need one, add it to the generated JSON by hand. See IAM Policy Basics for more on the identity-based vs. resource-based distinction.

Is anything I enter sent anywhere?

No — the policy is built entirely in your browser. Nothing here is ever sent to a server.