devpack
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início
Site Audit

AWS IAM Policy Generator — Least-Privilege Policies for S3, DynamoDB, Lambda & More

Write AWS IAM policies without memorizing action names. Add a permission for each service — S3, DynamoDB, SQS, SNS, Lambda, CloudWatch Logs, Secrets Manager, SES, ECR, KMS, CloudFront — choose read, write or full access and the exact resource, and get a valid least-privilege policy JSON with proper ARNs. Add conditions for MFA, source IP and HTTPS, or switch to S3 bucket policy mode for CloudFront, cross-account and public-read setups.

Runs in your browserUpdated

Permissions

Conditions

Policy JSON
Apply it with the AWS CLI

Your data never leaves your computer. All processing happens 100% locally in your browser.

How to use the AWS IAM Policy Generator

  1. Choose IAM policy to attach to a user or role, or S3 bucket policy to attach to a bucket.
  2. Enter your account ID and region so the ARNs are complete.
  3. Add one permission per service with + Add permission: pick the access level (read, write, full) and the resource name — a bucket, table, queue, function or secret. Remove one with ×.
  4. Tick conditions such as Require MFA or HTTPS only, then copy the JSON or the AWS CLI command. Fix anything flagged in the warnings first.

Least privilege in practice

An IAM policy is a list of statements: an Effect (Allow or Deny), the Actions it covers and the Resources they apply to, optionally with Conditions. Least privilege means granting only the actions a workload really uses, on only the resources it needs — so a leaked key can’t delete your database or read every bucket.

  • Avoid "Action": "*" and "Resource": "*"; the generator warns when a statement uses them.
  • S3 needs two resource forms: arn:aws:s3:::bucket for ListBucket and arn:aws:s3:::bucket/* for objects — the generator splits them automatically.
  • A few actions only work on *, such as ecr:GetAuthorizationToken; those get their own statement.

Bucket policies

A bucket policy is attached to the bucket and names a Principal — another account, a role, CloudFront or everyone. The recommended setup for websites is a private bucket that only CloudFront with Origin Access Control can read, plus a statement that denies plain-HTTP requests. Public read needs S3 Block Public Access turned off, so only use it for truly public files.

Test policies before production with the IAM policy simulator, and review access with IAM Access Analyzer. Related: Kubernetes YAML Generator, CORS Header Generator.

Also searched as: iam policy generator, aws policy generator, s3 bucket policy generator, least privilege iam policy, iam policy json, aws iam policy example, dynamodb iam policy, lambda iam policy.

Tools that pair well with the AWS IAM Policy Generator

  • GitLab CI Generator — Pick your stack and get a working .gitlab-ci.yml: install with caching, lint and test jobs, a build with artifacts, a Docker image pushed to the GitLab registry, or a GitLab Pages deploy — with rules that run pipelines for merge requests and your default branch without duplicates.
  • GitHub Actions Workflow Generator — Choose your stack, triggers and steps and get a commented .github/workflows/ci.yml — install, cache, lint, test, build, a version matrix and optional deploy to GitHub Pages, Vercel or a container registry.
  • YAML Validator — Paste a Docker Compose file, Kubernetes manifest, GitHub Actions workflow or any YAML to pinpoint errors, catch common pitfalls and get a cleanly formatted version.
  • systemd Service Generator — Run your app as a proper Linux service that starts on boot and restarts when it crashes.

Frequently asked questions

How do I give a Lambda function access to one S3 bucket?
Add an S3 permission with Read (or Read and write) and the bucket name, plus a CloudWatch Logs write permission for its logs. Attach the policy to the function’s execution role.
Why does s3:ListBucket need a different resource?
ListBucket acts on the bucket itself (arn:aws:s3:::bucket), while GetObject and PutObject act on objects (arn:aws:s3:::bucket/*). The generator writes both automatically.
What is the difference between an IAM policy and a bucket policy?
An IAM policy is attached to a user, group or role and says what they may do. A bucket policy is attached to a bucket and says who may use it — including other accounts and AWS services like CloudFront.
Is a generated policy safe to use as is?
It is a least-privilege starting point. Check the resource names, keep the warnings in mind and test it with the IAM policy simulator before using it in production.
Can I install AWS IAM Policy Generator as a web app and use it offline?
Yes. AWS IAM Policy Generator is an installable web app (PWA) — installed from your browser, not downloaded from an app store. Click Install app at the top of this page in Chrome or Edge (Windows, macOS, Linux, ChromeOS) or on Android, use Share → Add to Home Screen on iPhone and iPad, or File → Add to Dock in Safari 17+ on a Mac. It then opens in its own window with its own icon, and because it runs entirely in your browser it keeps working offline. Firefox on desktop can’t install web apps. How installing works.

Related tools

localKubernetes YAML GeneratorFill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with…localGitLab CI GeneratorPick your stack and get a working .gitlab-ci.yml: install with caching, lint and test jobs, a build with…localGitHub Actions Workflow GeneratorChoose your stack, triggers and steps and get a commented .github/workflows/ci.yml — install, cache, lint,…localJSON FormatterPaste JSON to pretty-print, minify or validate it. Errors are pinpointed to the exact line and column with…apiCORS Header Generator & TesterSeeing “has been blocked by CORS policy”? Describe who may call your API — origins, methods, headers,…localYAML ValidatorPaste a Docker Compose file, Kubernetes manifest, GitHub Actions workflow or any YAML to pinpoint errors,…