DevTools Logo

IAM Policy Generator

IAM Policy Generator

Build AWS IAM policy JSON from a list of statements.

Statement 1

Generated policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Sid": "ReadOnlyAccess"
    }
  ]
}
client-side
JSON

Examples

Read-only S3 access

Input
Effect: Allow
Actions: s3:GetObject, s3:ListBucket
Resource: arn:aws:s3:::my-bucket/*
Output
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::my-bucket/*" } ] }

Two actions become an array, a single resource stays a string, and the policy uses the canonical version.

About this tool

The IAM Policy Generator turns a list of statements into a valid AWS IAM policy document. For each statement you choose Allow or Deny, list the actions (such as s3:GetObject or ec2:*), and list the resources they apply to (an ARN or *). An optional Sid names the statement.

The generator wraps everything in the standard { Version: 2012-10-17, Statement: [...] } shape, collapses a single action or resource to a string and keeps multiples as arrays, and warns when a statement is incomplete. Everything runs in your browser — nothing is uploaded.

How to use

  1. Add statements

    For each, pick the effect, enter actions and resources (one per line), and an optional Sid.

  2. Read the JSON

    The preview shows the assembled policy; warnings flag empty actions or resources.

  3. Copy into AWS

    Paste the JSON into the IAM console, a Terraform aws_iam_policy document, or a CloudFormation template.

Use cases

Least-privilege roles

Draft tight Allow statements per service instead of using broad managed policies.

Infrastructure as code

Generate the policy JSON to drop into Terraform or CloudFormation.

Common mistakes

Mistake:Using * for the resource.

Fix:Scope resources to specific ARNs where possible — a wildcard resource widens the blast radius.

Mistake:Mixing service namespaces.

Fix:Actions are namespaced (s3:, ec2:); keep each statement to one service for clarity.

Frequently asked questions

Related guides

S3 Bucket Policies: Who Can Do What to Which Objects

How an S3 bucket policy differs from IAM, the Principal/Action/Resource triple, and when to scope by key prefix or include the bucket ARN.

Writing IAM Policies by Hand (Without Shooting Yourself in the Foot)

The anatomy of an AWS IAM policy — Version, Statement, Effect, Action, Resource — and how to keep permissions tight and readable.

References & standards

Related tools

.htaccess Generator

Build an Apache .htaccess — HTTPS redirects, rewrites, error pages, security headers, and basic auth

Ansible Playbook Generator

Build an Ansible playbook — hosts, vars, and tasks with modules — as YAML

Apache Config Generator

Build an Apache 2.4 VirtualHost — ServerName, DocumentRoot, Directory, aliases, and optional SSL

CHANGELOG Generator

Write a clean, consistent CHANGELOG entry in the Keep a Changelog format from grouped Added, Changed, Deprecated, Removed, Fixed, and Security notes

Chmod Calculator

Calculate Linux file permissions (777, 755 etc) easily.

CircleCI Config Generator

Generate a .circleci/config.yml — jobs with Docker images and run steps wired into a workflow