IAM Policy Viewer

What this tool does

An IAM policy document is JSON, but reading raw JSON to answer "what does this statement actually allow?" is slow. Paste a policy in and each statement gets a plain-English summary, plus its actions, resources, principal, and conditions broken out individually — and a check for a few genuine structural problems per AWS's own JSON policy element reference.

What gets checked

• Effect must be exactly "Allow" or "Deny" — anything else is flagged.
• Action/NotAction, Resource/NotResource, and Principal/NotPrincipal are each mutually exclusive pairs — AWS won't accept a statement using both halves of one of these pairs, so this tool flags it too.
• Version gets a note if it's missing, or if it's the legacy 2008-10-17 instead of the current 2012-10-17 — policy variables and other newer features silently don't work under the legacy version.

What this tool deliberately doesn't claim to check: whether a Resource is required for a given statement. It often is — but a role trust policy's sts:AssumeRole statement is a common, entirely valid exception that has no Resource at all, and there's no reliable way to tell from the JSON alone whether a given statement is one of these exceptions.

FAQ

Does this tell me if the policy actually grants the access I expect?

No — full policy evaluation also depends on any other policies attached to the same identity, permissions boundaries, service control policies, and resource-based policies on the other side of the call. This tool only explains what this one document says, structurally. See IAM Policy Basics for the three-rule core of how AWS actually decides allow or deny. For an ARN referenced in a Resource element, see ARN Parser or What Is an ARN?.

Can I build a policy from scratch here instead?

Use IAM Policy Generator — pick an effect, actions, and resources, and it writes the JSON for you.

This statement uses * for Action or Resource — is that a problem?

Not structurally, but it's worth a second look. A wildcard grants everything that matches it, which is easy to reach for and hard to walk back later. See Least Privilege Explained for what narrowing one down actually looks like.

Is my policy document sent anywhere?

No — parsing happens entirely in your browser. Nothing you paste here is ever sent to a server.