IAM · Resource policy · SCP · Permissions boundary
Paste AWS policy JSON. See who can actually reach what, why they can reach it, and what breaks if that identity is stolen.
Runs entirely in this browserIdentity-based policy attached to a user, group or role. No Principal block.
Any resource-based policy: S3 bucket, SQS queue, SNS topic, Secrets Manager secret, Lambda function or ECR repository. Resource-based, so every statement needs a Principal. The service is detected from the actions inside it.
Service control policy from AWS Organizations. It sets the ceiling. It never grants access on its own.
CloudTrail events as {"Records":[...]}, a plain array, or CSV rows of eventSource,eventName.
A KMS key policy, or {"keyArn":"...","keyPolicy":{},"grants":[]}. Pasting one treats the bucket as SSE-KMS encrypted.
A role trust policy, or a list of roles for chaining: [{"role":"arn:...","trustPolicy":{},"identityPolicy":{}}]
Permissions boundary on the user or role. Also a ceiling, applied to identity-based grants only.
Paste at least one policy on the left, then run the analysis. Paste both an IAM policy and a resource policy (S3, SQS, SNS, Secrets Manager, Lambda or ECR) to see the combined, final answer for a principal.