Your files stay on your device

Cloud IAM policy analyzer

Reviews pasted AWS IAM, Azure RBAC or GCP IAM policy JSON for wildcards, over-broad allows, escalation combinations and missing conditions, with provider auto-detection and CSV or JSON export.

Paste a policy document and press Analyze.

This is static analysis of one document. It cannot see your account, so it does not know which roles are actually attached, who can assume them, what permission boundaries or service control policies apply, or what a principal can reach at runtime. Escalation findings match documented action combinations in the pasted text; they are patterns, not proof that an attacker could use them. The severity of a finding drops one level when a non-empty Condition narrows the grant, which is credit for guard-rails the document itself states, nothing more.
OptionsAnalyze

More config file tools

- nginx.conf explainer (/config/nginx)
- SSH config explainer (/config/ssh)
- JSON validator (/json/validator)
All config file tools (/config)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/config/cloud-iam-policy-analyzer
Markdown version: https://nutter.tools/config/cloud-iam-policy-analyzer.md
Plain-text version: https://nutter.tools/config/cloud-iam-policy-analyzer.txt
Agent index: https://nutter.tools/llms.txt