Free tool · no account
AWS IAM policy explainer
Paste an IAM policy and read what each statement allows or denies in plain English. The explainer flags the patterns that most often grant more than intended: full admin access, `NotAction`, service-wide wildcards, `iam:PassRole` on any role, wildcard principals, and actions known to allow privilege escalation.
Identity or resource policy, or the output of aws iam get-policy-version.
Paste a policy to read it in plain English and see the patterns that most often grant more than intended.
Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.
Next step
Narrow keys, released to the right people
Shortspan controls who can obtain an AWS key, not what the key can do - so register the narrowest key this explainer helps you write, and shortspan aws releases it only to people with access, recording every release.
What it flags
"Action": "*" on "Resource": "*" is full administrator access. Allow with NotAction grants everything not listed, including services AWS adds later. iam:PassRole on any resource lets a principal hand any role to a service it controls and act with that role’s permissions. A wildcard principal with no condition opens a resource to anyone.
Actions such as iam:CreatePolicyVersion, iam:AttachRolePolicy, and iam:CreateAccessKey let a principal raise its own permissions; public privilege-escalation research lists them, and the explainer does too.
What it does not do
It reads the policy text only. Whether a request is actually allowed also depends on other identity and resource policies, permission boundaries, session policies, and service control policies. IAM Access Analyzer and the IAM policy simulator evaluate all of those.
Common questions
- Why does Version matter?
- Without
"Version": "2012-10-17", AWS applies the older language rules, and policy variables such as${aws:username}are read as literal text. - Is Resource "*" always wrong?
- No. Some actions - many List and Describe calls - only accept
*. For actions that support resource ARNs, naming them limits the damage a mistake or a stolen credential can do. - Is my policy sent anywhere?
- No. It is parsed in your browser. Policies are not secret in themselves, but they map your account, so it is worth keeping them private.
More free tools