Cloud IAM Policy Analyzer
Flag risky wildcards in a pasted IAM policy.
Runs in your browser. Nothing is uploaded — your input is processed on this device and discarded when you close the tab.
Cloud IAM Policy Analyzer
How to use this tool
- Enter your values in the fields above.
- Press Generate to see the result.
- Use Load sample to try the worked example, Copy result to copy it, or Clear to start again.
Worked example
A policy allowing s3:* on resource * reports 2 flags: one wildcard action and one wildcard resource.
What this tool does not do / Limits
This checks pasted JSON only for wildcard patterns. It does not read any cloud account and does not judge whether a permission is actually needed.
Frequently asked questions
Does this connect to my cloud account?
No. It only reads the JSON you paste, and nothing is uploaded.
Is every wildcard bad?
Not always, but wildcards widen access, so each one should be reviewed and narrowed where possible.
Related tools
JSON Studio
Format, validate, minify, query and compare JSON in your browser, with precise line-and-column errors.
LiveRegex Tester
Test patterns against sample text with match highlighting, capture groups and a safe one-second timeout.
LiveSecurity Header and DNS Checker
Check HSTS, CSP and other security headers, TLS details, and DNS/email authentication records (SPF, DKIM, DMARC).
Live