IAM Policy Linter

Paste an AWS IAM policy JSON document and get a local verdict with stable rule codes, severity-ranked findings, source lines, JSON paths and text, JSON or CSV output.

About this tool

IAM Policy Linter checks one AWS IAM policy JSON document in your browser. It is designed for quick reviews before a policy lands in Terraform, CloudFormation, a ticket or a pull request: paste the document, choose how AWS will attach it, and get a severity-ranked report with stable rule codes, JSON paths and source lines.

The linter covers structural policy grammar, policy-type differences, dangerous wildcard grants, Allow statements that use NotAction, NotResource or NotPrincipal, public principals, iam:PassRole on unconstrained resources, and curated sensitive action families such as credential exposure, data exfiltration, resource exposure and privilege escalation when they are paired with Resource: "*".

Worked example

Paste this identity policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "*",
      "Resource": "*"
    }
  ]
}

The report starts with an UNSAFE verdict and an ADMIN-STAR finding at $.Statement[0].Action, with the source line that contains the wildcard action. Switch Output as to JSON when you want a CI-friendly object with verdict, summary and findings, or CSV when you need rows for a spreadsheet or a review ticket.

Limits and edge cases

JSON only. AWS IAM policy bodies are JSON; YAML templates and embedded CloudFormation/Terraform extraction are outside this single-policy tool.
The tool is catalogue-free: it validates action grammar such as service:Action, but it does not embed the full AWS service/action/resource catalogue and will not claim an action name is unknown.
It does not call AWS, inspect accounts, load managed policies or need credentials. Everything runs locally in the browser.
The managed-policy size check uses the 6,144-character quota after whitespace is removed. The input hard cap is 200,000 characters to keep browser runs responsive.
min_severity hides lower-severity rows from the rendered output only. The verdict still counts every non-ignored finding.
ignore is explicit and strict: unknown rule codes are errors, so a typo cannot silently suppress nothing.

FAQ

Is this the same as AWS IAM Access Analyzer?

No. It mirrors the most useful local checks — policy structure, policy-type rules, wildcards, public principals and common risky permission patterns — but it does not call AWS or use AWS's full private validation catalogue. Use AWS IAM Access Analyzer for authoritative service-specific validation before deployment.

Why does the linter not flag an unknown action like s3:GetObjectt?

A complete AWS action and resource-type catalogue is large and changes frequently. Embedding a stale snapshot in a browser tool would create confident false positives and false negatives. This linter checks action grammar and high-risk patterns; service-specific action existence remains an AWS-side validation step.

When should I use each policy type?

Use identity for policies attached to users, groups or roles. Use resource for bucket, queue, key, repository and similar resource policies where Principal is expected. Use trust for a role's AssumeRolePolicyDocument. Use scp for AWS Organizations service control policies, where several identity-policy elements have different rules.

Does ignoring a finding change the verdict?

Yes. ignore represents an explicit reviewed suppression, so ignored codes are removed before the verdict is computed. By contrast, min_severity is only a display filter and never changes the verdict.

Developer & Automation Access

Run it from the terminal

Same engine as this page, headless — via the gizza CLI:

gizza tool iam-policy-linter '{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
  }]
}'

New to the CLI? Get gizza →

Open it by URL

Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:

https://gizza.ai/tools/iam-policy-linter/?policy=%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0A%20%20%22Statement%22%3A%20%5B%7B%0A%20%20%20%20%22Effect%22%3A%20%22Allow%22%2C%0A%20%20%20%20%22Action%22%3A%20%22%2A%22%2C%0A%20%20%20%20%22Resource%22%3A%20%22%2A%22%0A%20%20%7D%5D%0A%7D&policy_type=identity&format=text&min_severity=low&ignore=MISSING-VERSION%2C%20RESOURCE-STAR

Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.