Loading tool
Test case
s3:ListBucket
Action
Expected result
Resource ARN
Actual result
Test AWS IAM policy decisions against expected allow and deny cases with action search and resource ARNs.
IAM JSON policy
Simulation setup
Test case
s3:ListBucket
Test case
s3:GetObject
Paste an AWS IAM JSON policy, add test cases for specific IAM actions and resources, and compare the expected permission result with the simulator output. Use it to check identity policies and resource policies before a pull request, Terraform apply, or console change.
Start with the AWS IAM policy generator when you need to build the JSON from action metadata. Use this tester to verify important allow and deny paths, then run the IAM policy validator to review syntax and best-practice findings or the IAM policy converter to turn the final JSON into Terraform, CloudFormation, or CDK snippets.
No. The tester runs with the Cloud Copilot IAM simulator package and does not need AWS credentials.
Denied passes when the simulator returns either an explicit deny or an implicit deny. Use the actual result badge when you need to distinguish between those two IAM outcomes.
No. This version evaluates the pasted policy as an identity policy or a resource policy. It does not model service control policies, resource control policies, permission boundaries, session policies, or deployed account inventory.
Related tools
Validate and test AWS IAM JSON policy documents with inline errors, warnings, and Access Analyzer-inspired security checks.
Convert AWS IAM JSON policy documents into Terraform, CloudFormation, CDK TypeScript, or CDK Python snippets.
Generate AWS IAM policies from searchable action metadata and export ready-to-use JSON, Terraform, or CloudFormation snippets.
Next step
I build these tools to make AWS easier to manage. If this level of quality is what you want in your own cloud platform, Towards The Cloud can help with landing zones, infrastructure as code, security reviews, migrations, and cost optimization.