AWS IAM Policy Generator

Generate least-privilege AWS IAM policies for common jobs: S3 bucket or prefix access, consuming an SQS queue, sending with SES, reading a secret and pushing to ECR.

Free · No sign-up · Your inputs stay in your browser

Input

Generate a least-privilege AWS IAM policy

Permission

Bucket

Require TLS (aws:SecureTransport)Only from these IPs or CIDRsOptional. Breaks requests that arrive through a VPC endpoint, which carry no public source IP.

Output

Policy JSON

551 characters

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Objects",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::acme-uploads/*"
      ],
      "Condition": {
        "Bool": {
          "aws:SecureTransport": "true"
        }
      }
    },
    {
      "Sid": "List",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::acme-uploads"
      ]
    }
  ]
}

ListBucket is granted on the bucket ARN and object actions on bucket/*: the two resources are different, and putting both actions on one of them is the classic reason a policy 'does not work'. Check a policy with the IAM policy simulator before attaching it to a role.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

The S3 mistake everyone makes once

s3:ListBucket applies to the bucket ARN (arn:aws:s3:::name) and s3:GetObject to object ARNs (arn:aws:s3:::name/*). Granting both on one of them silently fails half the calls. The IAM policy elements reference describes each block.

Test before attaching

The IAM policy simulator in the console evaluates a policy against specific actions and resources. IAM Access Analyzer can also generate a policy from CloudTrail activity, which is the most accurate way to narrow an existing over-broad role.

Frequently asked questions

What is the difference between an IAM policy and a bucket policy?

An identity policy is attached to a user or role and says what it may do. A bucket policy is attached to the bucket and says who may access it. Cross-account access usually needs both.

Why use aws:SecureTransport?

It denies requests made over plain HTTP. Combined with a bucket policy that denies when it is false, it guarantees data in transit is encrypted.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

AWS IAM Policy Generator

Generate a least-privilege AWS IAM policy

Policy JSON

The S3 mistake everyone makes once

Test before attaching

Frequently asked questions

Similar tools

File Type Detector

CSR Generator

CAA Record Generator