AWS IAM Policy Auditor

// identity policies · wildcards · privilege escalation · PassRole

An identity policy attached to a user, group or role. The output of aws iam get-policy-version or aws iam get-role-policy works too; the wrapper is removed for you.

Findings

    
        
    
      
    

      
    
        
    
          
    Statements
    
          
        
    
        
    
          
    
        
    
      
    
    
    

    
    
      
    
        
    Get your own policy
    
      
    
      
    
        A customer-managed policy (find the default version with aws iam get-policy)
        
    aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/POLICY_NAME --version-id v1
    
        An inline policy on a role
        
    aws iam get-role-policy --role-name ROLE_NAME --policy-name POLICY_NAME
    
        
    AWS IAM Access Analyzer can also validate policies, but it needs an AWS account and credentials. This page works offline and explains why each finding matters. It checks one policy at a time: what an identity can really do also depends on its other policies, permissions boundaries, SCPs and resource policies.