# IAM Policy Linter
Lint AWS IAM policy JSON locally for syntax errors, wildcard permissions, public principals, NotAction/NotResource risks and sensitive actions on Resource *.
## Run it
- **CLI:** `gizza tool iam-policy-linter '{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}]
}'`
- **Web:** https://gizza.ai/tools/iam-policy-linter/
- **Agents:** machine-readable descriptor (parameters JSON Schema) at https://gizza.ai/tools/iam-policy-linter/tool.json
## Inputs
- `policy` — IAM policy JSON _(field)_
- `policy_type` — Policy type _(field)_
- `format` — Output as _(field)_
- `min_severity` — Show severity _(field)_
- `ignore` — Ignore rule codes _(field)_
## Output
- Lint report (text)
## Query parameters
Open the tool pre-filled and auto-run via URL:
- `policy` — IAM policy JSON
- `policy_type` — Policy type
- `format` — Output as
- `min_severity` — Show severity
- `ignore` — Ignore rule codes
Example: `https://gizza.ai/tools/iam-policy-linter/?policy=%7B%0A%20%20%22Version%22%3A%20%222012-10-17%22%2C%0A%20%20%22Statement%22%3A%20%5B%7B%0A%20%20%20%20%22Effect%22%3A%20%22Allow%22%2C%0A%20%20%20%20%22Action%22%3A%20%22%2A%22%2C%0A%20%20%20%20%22Resource%22%3A%20%22%2A%22%0A%20%20%7D%5D%0A%7D&policy_type=identity&format=text&min_severity=low&ignore=MISSING-VERSION%2C%20RESOURCE-STAR`
---
## About this tool
IAM Policy Linter checks one AWS IAM policy JSON document in your browser. It is designed for quick reviews before a policy lands in Terraform, CloudFormation, a ticket or a pull request: paste the document, choose how AWS will attach it, and get a severity-ranked report with stable rule codes, JSON paths and source lines.
The linter covers structural policy grammar, policy-type differences, dangerous wildcard grants, `Allow` statements that use `NotAction`, `NotResource` or `NotPrincipal`, public principals, `iam:PassRole` on unconstrained resources, and curated sensitive action families such as credential exposure, data exfiltration, resource exposure and privilege escalation when they are paired with `Resource: "*"`.
### Worked example
Paste this identity policy:
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "*",
"Resource": "*"
}
]
}
```
The report starts with an `UNSAFE` verdict and an `ADMIN-STAR` finding at `$.Statement[0].Action`, with the source line that contains the wildcard action. Switch **Output as** to JSON when you want a CI-friendly object with `verdict`, `summary` and `findings`, or CSV when you need rows for a spreadsheet or a review ticket.
### Limits and edge cases
- JSON only. AWS IAM policy bodies are JSON; YAML templates and embedded CloudFormation/Terraform extraction are outside this single-policy tool.
- The tool is catalogue-free: it validates action grammar such as `service:Action`, but it does not embed the full AWS service/action/resource catalogue and will not claim an action name is unknown.
- It does not call AWS, inspect accounts, load managed policies or need credentials. Everything runs locally in the browser.
- The managed-policy size check uses the 6,144-character quota after whitespace is removed. The input hard cap is 200,000 characters to keep browser runs responsive.
- `min_severity` hides lower-severity rows from the rendered output only. The verdict still counts every non-ignored finding.
- `ignore` is explicit and strict: unknown rule codes are errors, so a typo cannot silently suppress nothing.
## FAQ
Is this the same as AWS IAM Access Analyzer?
No. It mirrors the most useful local checks — policy structure, policy-type rules, wildcards, public principals and common risky permission patterns — but it does not call AWS or use AWS's full private validation catalogue. Use AWS IAM Access Analyzer for authoritative service-specific validation before deployment.
Why does the linter not flag an unknown action like s3:GetObjectt?
A complete AWS action and resource-type catalogue is large and changes frequently. Embedding a stale snapshot in a browser tool would create confident false positives and false negatives. This linter checks action grammar and high-risk patterns; service-specific action existence remains an AWS-side validation step.
When should I use each policy type?
Use **identity** for policies attached to users, groups or roles. Use **resource** for bucket, queue, key, repository and similar resource policies where `Principal` is expected. Use **trust** for a role's `AssumeRolePolicyDocument`. Use **scp** for AWS Organizations service control policies, where several identity-policy elements have different rules.
Does ignoring a finding change the verdict?
Yes. `ignore` represents an explicit reviewed suppression, so ignored codes are removed before the verdict is computed. By contrast, `min_severity` is only a display filter and never changes the verdict.
## Related tools
- [DynamoDB JSON Converter](https://gizza.ai/tools/dynamodb-json-converter/): Convert between DynamoDB typed AttributeValue JSON and plain JSON in both directions, with auto-detect and pretty or compact output.
- [AWS Signature V4 Signer](https://gizza.ai/tools/aws-sigv4-signer/): Generate AWS SigV4 canonical requests, strings to sign, signatures, and Authorization headers locally for S3, IAM, and AWS APIs.
- [MongoDB Extended JSON Converter](https://gizza.ai/tools/bson-extended-json-converter/): Convert MongoDB Extended JSON ($oid, $date, $numberLong) to and from plain JSON, with canonical or relaxed output, in your browser.
- [Validate a PEM certificate chain offline](https://gizza.ai/tools/cert-chain-validate/): Check a pasted PEM certificate chain offline for leaf-to-root ordering, signature linkage and expiry windows.
- [Identify a data sample's format, delimiter and columns](https://gizza.ai/tools/data-format-sniffer/): Paste a data sample and find out what it is: CSV, TSV, JSON, JSON Lines, XML, HTML, fixed-width or binary, plus delimiter, quote char, encoding and column types.