AWS IAM Policy Builder
Build and validate AWS IAM policy JSON in your browser.
Loading tool...
What is AWS IAM Policy Builder?
AWS IAM Policy Builder is a free online tool for constructing AWS IAM policy documents statement by statement. Add Allow or Deny effects, actions, resources, principals, and condition blocks through a structured editor, and the tool emits a clean Version 2012-10-17 policy JSON — all computed locally in your browser.
Key Benefits
- Structured editor prevents malformed policy JSON
- Live validation catches missing elements early
- Bundled action suggestions speed up writing
- Private and offline — nothing leaves the browser
Common Use Cases
- •Drafting least-privilege policies for a new service
- •Building S3 bucket policies with specific principals
- •Creating role trust policies with condition guards
- •Teaching IAM concepts with instantly generated JSON
How to Build an IAM Policy
- Set the effect: Each statement starts with Allow or Deny. Deny always wins over Allow in IAM evaluation.
- Add actions and resources: List service:action pairs like s3:GetObject one per line, then the ARNs they apply to. Use NotAction or NotResource to invert the match.
- Optionally add principals and conditions: Principals are for resource-based policies only. Conditions like IpAddress or StringEquals scope the statement further.
- Generate and copy: Click Generate policy, review the validation notes, then copy the JSON or download it for the AWS Console.
Key Features
- Statement editor with Allow and Deny effects
- Action, NotAction, Resource, NotResource, and Principal support
- Condition blocks with 15 common operators
- Live validation notes flag structural mistakes as you type
- Quick-add buttons for common S3, EC2, and DynamoDB actions
- Copy or download the policy as formatted JSON
Frequently Asked Questions
What is the difference between Action and NotAction?
Action lists exactly what the statement allows or denies. NotAction matches everything EXCEPT the listed actions, which is handy when a policy should cover a whole service minus a few dangerous operations.
When should a statement include a Principal?
Only in resource-based policies such as S3 bucket policies, KMS key policies, and role trust policies. Identity policies attached to users, groups, or roles must NOT have a Principal element.
Is my policy uploaded anywhere?
No. The builder runs entirely in your browser with JavaScript. Nothing is sent to any server, so it is safe to draft internal policies here.
Does the tool validate against real AWS IAM rules?
It performs structural validation: required elements, ARN shape, condition completeness, and known anti-patterns. It cannot verify that an action exists for a service or simulate access — use the AWS Policy Simulator for that.