AWS IAM Policy Generator
Generate least-privilege AWS IAM policies for common jobs: S3 bucket or prefix access, consuming an SQS queue, sending with SES, reading a secret and pushing to ECR.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a least-privilege AWS IAM policy
Output
Policy JSON
551 characters
ListBucket is granted on the bucket ARN and object actions on bucket/*: the two resources are different, and putting both actions on one of them is the classic reason a policy 'does not work'. Check a policy with the IAM policy simulator before attaching it to a role.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
The S3 mistake everyone makes once
s3:ListBucket applies to the bucket ARN (arn:aws:s3:::name) and s3:GetObject to object ARNs (arn:aws:s3:::name/*). Granting both on one of them silently fails half the calls. The IAM policy elements reference describes each block.
Test before attaching
The IAM policy simulator in the console evaluates a policy against specific actions and resources. IAM Access Analyzer can also generate a policy from CloudTrail activity, which is the most accurate way to narrow an existing over-broad role.
