AWS IAM and S3 policy checker
Paste an IAM policy, an S3 bucket policy or a role trust policy (including GitHub Actions OIDC roles). It lists risky settings and how to fix them, and it runs in your browser.
Runs in your browser, nothing is uploadedTry an example:,,
This is a quick first pass based on common mistakes. It does not replace IAM Access Analyzer or a human review, and it cannot see how other policies on the same account combine. Never paste real secrets: policies contain none, but check before you paste.
How to use the IAM policy checker
- Paste the policy JSON. Leave the type on "Detect automatically" unless you know which kind it is.
- Press Check policy. Each finding shows the statement, why it is risky and how to fix it, most serious first.
- Fix the policy in your Terraform or console, paste the new version and check again until the serious findings are gone.
Example: a GitHub Actions deploy role
A role trust policy lets GitHub Actions assume a deploy role, but its condition uses "repo:my-org/*". The checker flags it: any repository in the organisation, and any branch, could deploy to production.
The fix is to pin the subject to one repository and branch, such as "repo:my-org/web:ref:refs/heads/main", and to check the audience is sts.amazonaws.com.
Common questions
Does it replace IAM Access Analyzer?
No. It is a fast first pass for common mistakes. Access Analyzer sees every policy on the account together and should still run on production accounts.
Which policy types does it check?
IAM permissions policies, S3 bucket policies and role trust policies, including the OIDC conditions used by GitHub Actions.
Is it safe to paste a policy?
Policies contain no secrets, and nothing leaves your browser. Still, remove account IDs if you are sharing a screenshot.
Read next: 3 AWS IAM mistakes I find in almost every account
Want the real numbers for your AWS account?
Send me your setup and I will return a written list of savings and security fixes, safest first. It is free.