AWS IAM Policy Tester

Test AWS IAM policy decisions against expected allow and deny cases with action search and resource ARNs.

IAM JSON policy

Simulation setup

Test cases

Policy type
Principal ARN

Test case

s3:ListBucket

Action
Expected result
Resource ARN
Actual result

Test case

s3:GetObject

Action
Expected result
Resource ARN
Actual result

Test IAM policy decisions before deployment

Paste an AWS IAM JSON policy, add test cases for specific IAM actions and resources, and compare the expected permission result with the simulator output. Use it to check identity policies and resource policies before a pull request, Terraform apply, or console change.

How to use the IAM policy tester

  1. Paste, upload, or load an example IAM JSON policy.
  2. Choose whether the policy should be evaluated as an identity policy or a resource policy.
  3. Set the principal ARN used for resource-policy principal matching.
  4. Add test cases with an IAM action, expected result, and resource ARN.
  5. Review whether each case is allowed, explicitly denied, implicitly denied, or blocked by an input error.

Policy testing workflow

Start with the AWS IAM policy generator when you need to build the JSON from action metadata. Use this tester to verify important allow and deny paths, then run the IAM policy validator to review syntax and best-practice findings or the IAM policy converter to turn the final JSON into Terraform, CloudFormation, or CDK snippets.

Frequently asked questions

Does this IAM policy tester call AWS?

No. The tester runs with the Cloud Copilot IAM simulator package and does not need AWS credentials.

What does Denied mean in expected results?

Denied passes when the simulator returns either an explicit deny or an implicit deny. Use the actual result badge when you need to distinguish between those two IAM outcomes.

Does this model SCPs or permission boundaries?

No. This version evaluates the pasted policy as an identity policy or a resource policy. It does not model service control policies, resource control policies, permission boundaries, session policies, or deployed account inventory.

Related tools

AWS IAM Policy Validator

Validate and test AWS IAM JSON policy documents with inline errors, warnings, and Access Analyzer-inspired security checks.

IAM Policy Converter

Convert AWS IAM JSON policy documents into Terraform, CloudFormation, CDK TypeScript, or CDK Python snippets.

AWS IAM Policy Generator

Generate AWS IAM policies from searchable action metadata and export ready-to-use JSON, Terraform, or CloudFormation snippets.

Next step

Want AWS engineering that feels this practical?

I build these tools to make AWS easier to manage. If this level of quality is what you want in your own cloud platform, Towards The Cloud can help with landing zones, infrastructure as code, security reviews, migrations, and cost optimization.

Explore AWS services
← Back to tools