devpack
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início
Auditoria do site

Esta página ainda não foi traduzida para o português, por isso aparece em inglês.

AWS IAM Policy Generator — Least-Privilege Policies for S3, DynamoDB, Lambda & More

Write AWS IAM policies without memorizing action names. Add a permission for each service — S3, DynamoDB, SQS, SNS, Lambda, CloudWatch Logs, Secrets Manager, SES, ECR, KMS, CloudFront — choose read, write or full access and the exact resource, and get a valid least-privilege policy JSON with proper ARNs. Add conditions for MFA, source IP and HTTPS, or switch to S3 bucket policy mode for CloudFront, cross-account and public-read setups.

Atualizado em

Permissions

Conditions

Policy JSON
Apply it with the AWS CLI

Seus dados nunca saem do seu computador. Todo o processamento acontece localmente no navegador.

Como usar: AWS IAM Policy Generator

  1. Choose IAM policy to attach to a user or role, or S3 bucket policy to attach to a bucket.
  2. Enter your account ID and region so the ARNs are complete.
  3. Add one permission per service with + Add permission: pick the access level (read, write, full) and the resource name — a bucket, table, queue, function or secret. Remove one with ×.
  4. Tick conditions such as Require MFA or HTTPS only, then copy the JSON or the AWS CLI command. Fix anything flagged in the warnings first.

Least privilege in practice

An IAM policy is a list of statements: an Effect (Allow or Deny), the Actions it covers and the Resources they apply to, optionally with Conditions. Least privilege means granting only the actions a workload really uses, on only the resources it needs — so a leaked key can’t delete your database or read every bucket.

  • Avoid "Action": "*" and "Resource": "*"; the generator warns when a statement uses them.
  • S3 needs two resource forms: arn:aws:s3:::bucket for ListBucket and arn:aws:s3:::bucket/* for objects — the generator splits them automatically.
  • A few actions only work on *, such as ecr:GetAuthorizationToken; those get their own statement.

Bucket policies

A bucket policy is attached to the bucket and names a Principal — another account, a role, CloudFront or everyone. The recommended setup for websites is a private bucket that only CloudFront with Origin Access Control can read, plus a statement that denies plain-HTTP requests. Public read needs S3 Block Public Access turned off, so only use it for truly public files.

Test policies before production with the IAM policy simulator, and review access with IAM Access Analyzer. Related: Kubernetes YAML Generator, CORS Header Generator.

Também pesquisado como: iam policy generator, aws policy generator, s3 bucket policy generator, least privilege iam policy, iam policy json, aws iam policy example, dynamodb iam policy, lambda iam policy.

Ferramentas que combinam com: AWS IAM Policy Generator

  • GitLab CI Generator — Pick your stack and get a working .gitlab-ci.yml: install with caching, lint and test jobs, a build with artifacts, a Docker image pushed to the GitLab registry, or a GitLab Pages deploy — with rules that run pipelines for merge requests and your default branch without duplicates.
  • Gerador de fluxos de trabalho do GitHub Actions — Escolha sua pilha, gatilhos e etapas e receba um arquivo .github/workflows/ci.yml — instalação, cache, verificação de código, teste, compilação, uma matriz de versões e, opcionalmente, implantação no GitHub Pages, Vercel ou em um registro de contêineres.
  • Formatação JSON — Cole o JSON aqui para formatá-lo, compactá-lo ou validá-lo.
  • YAML Validator — Paste a Docker Compose file, Kubernetes manifest, GitHub Actions workflow or any YAML to pinpoint errors, catch common pitfalls and get a cleanly formatted version.

Perguntas frequentes

How do I give a Lambda function access to one S3 bucket?
Add an S3 permission with Read (or Read and write) and the bucket name, plus a CloudWatch Logs write permission for its logs. Attach the policy to the function’s execution role.
Why does s3:ListBucket need a different resource?
ListBucket acts on the bucket itself (arn:aws:s3:::bucket), while GetObject and PutObject act on objects (arn:aws:s3:::bucket/*). The generator writes both automatically.
What is the difference between an IAM policy and a bucket policy?
An IAM policy is attached to a user, group or role and says what they may do. A bucket policy is attached to a bucket and says who may use it — including other accounts and AWS services like CloudFront.
Is a generated policy safe to use as is?
It is a least-privilege starting point. Check the resource names, keep the warnings in mind and test it with the IAM policy simulator before using it in production.
Posso instalar o AWS IAM Policy Generator como um aplicativo da web e usá-lo offline?
Sim. O AWS IAM Policy Generator é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.

Ferramentas relacionadas

localKubernetes YAML GeneratorFill in your app’s name, image and port and get production-ready Kubernetes YAML: a Deployment with…localGitLab CI GeneratorPick your stack and get a working .gitlab-ci.yml: install with caching, lint and test jobs, a build with…localGerador de fluxos de trabalho do GitHub ActionsEscolha sua pilha, gatilhos e etapas e receba um arquivo .github/workflows/ci.yml — instalação, cache,…localFormatação JSONCole o JSON aqui para formatá-lo, compactá-lo ou validá-lo. Os erros são indicados com precisão, com a…apiCORS Header Generator & TesterSeeing “has been blocked by CORS policy”? Describe who may call your API — origins, methods, headers,…localYAML ValidatorPaste a Docker Compose file, Kubernetes manifest, GitHub Actions workflow or any YAML to pinpoint errors,…