IAM · Resource policy · SCP · Permissions boundary
Paste AWS policy JSON. See who can actually reach what, why they can reach it, and what breaks if that identity is stolen.
Runs entirely in this browser Read the source on GitHubIdentity-based policy attached to a user, group or role. No Principal block.
Any resource-based policy: S3 bucket, SQS queue, SNS topic, Secrets Manager secret, Lambda function or ECR repository. Resource-based, so every statement needs a Principal. The service is detected from the actions inside it.
Service control policy from AWS Organizations. It sets the ceiling. It never grants access on its own.
CloudTrail events as {"Records":[...]}, a plain array, or CSV rows of eventSource,eventName.
A KMS key policy, or {"keyArn":"...","keyPolicy":{},"grants":[]}. Pasting one treats the bucket as SSE-KMS encrypted.
A role trust policy, or a list of roles for chaining: [{"role":"arn:...","trustPolicy":{},"identityPolicy":{}}]
Permissions boundary on the user or role. Also a ceiling, applied to identity-based grants only.
Paste at least one policy on the left, then run the analysis. Paste both an IAM policy and a resource policy (S3, SQS, SNS, Secrets Manager, Lambda or ECR) to see the combined, final answer for a principal.