IAM Policy Plain-English Explainer
Paste an AWS IAM policy below and this page will say, in plain English, what it allows and what it blocks. Everything runs in your browser — nothing you paste is sent anywhere.
No policy handy? Load a sample:
What is an IAM policy?
An IAM policy is a set of rules attached to a person or service in AWS. It lists what they can do, and what they can do it to. Effect: Allow means they can do those things. Deny means they cannot — and a Deny wins over an Allow.
The risky part is Resource: *. That star means every bucket, table,
or other resource of that type, not just the one you meant. This tool only
explains what the words in the policy say. It does not check whether the policy
is safe for your account.