Does this calculate effective permissions?
No. AWS combines several policy types and request-context values. This tool analyzes one document and keeps that boundary visible.
AWS IAM Policy Inspector
Inspect AWS IAM identity, resource, and role trust policies; expand statements and conditions, and review broad or high-impact permissions locally.
Local input limit: 2 MB · Processing timeout: 5 s
Inspect an AWS IAM policy
Paste an identity, resource, or role trust policy. DecodeLens expands each statement and reports structural security observations without contacting AWS.
IAM policy JSON
0 KB
Policy analysis
Policy analysis
Policy type, expanded statements, conditions, high-impact action groups, and focused findings will appear here.
Review policy structure without deploying it
The inspector normalizes scalar and list forms, expands principals and conditions, groups actions by service, and highlights focused wildcard and high-impact permission patterns.
What this result does not prove
- The tool does not call AWS, Access Analyzer, IAM simulation APIs, or the live service authorization catalog.
- A finding is a review signal, not proof of exploitability. A clean result is not proof of least privilege or safe deployment.
- Effective permissions require every applicable policy layer and the concrete principal, action, resource, and condition context.
- Explicit Deny, permissions boundaries, session policies, SCPs, RCPs, resource policies, and cross-account rules are not inferred from a single pasted document.
- The policy stays in this browser and is processed in a disposable worker with bounded input, statement, depth, value, finding, and time limits.
Related tools for this workflow
Continue with tools that decode, convert, inspect, or verify the same data.
- API & network
AWS SigV4 & S3 Presigned URL Debugger
Inspect AWS Signature Version 4 requests and S3 presigned URLs, rebuild canonical inputs, and optionally compare the HMAC signature locally.
Open tool - Cloud & DevOps
Terraform State Inspector & Secret Scanner
Map terraform.tfstate resources, modules, providers, outputs, and possible credentials; download a separate non-operational redacted copy.
Open tool - Data formats
JSON Formatter & Validator
Format, minify, validate, and explore JSON in a collapsible Object View without uploading data.
Open tool - Security & identity
Security Headers / CSP / CORS Inspector
Inspect pasted response headers, curl output, or HAR data. Parse CSP and browser isolation headers, then compare CORS against explicit request context without fetching a URL.
Open tool
Audit a policy before deployment
Paste the exact policy JSON, confirm or select its policy type, review critical and high findings, then inspect the expanded statement and condition evidence before changing the policy in AWS.
Input
"Action": "iam:PassRole", "Resource": "*"Review
PassRole · broad resource · missing iam:PassedToServiceAWS IAM Policy Inspector FAQ
Is this AWS IAM Access Analyzer?
No. It is a local structural inspector with a focused rule set. Use AWS IAM Access Analyzer and policy simulation for AWS-backed validation and authorization testing.
Why is Resource * not always critical?
Some AWS actions do not support resource-level permissions and legitimately require *. The inspector raises stronger findings when broad resources combine with reviewed high-impact actions.
Is the policy uploaded?
No. Parsing and analysis run locally in a disposable browser worker. The policy is not sent to AWS or included in analytics.