Paste an AWS IAM policy, Azure RBAC role definition, or GCP IAM policy JSON to instantly flag dangerous permissions and overpermissive patterns.
IAM Policy Analyzer detects dangerous permission patterns across all three major cloud providers. For AWS IAM policies, it checks each Statement for wildcard actions, unrestricted Resource: *, sts:AssumeRole without conditions, and inverted logic patterns (NotAction/NotResource). For Azure RBAC role definitions, it flags Actions: * (full control plane access), AssignableScopes: / (root management group scope), service wildcards like Microsoft.Compute/*, and NotActions patterns. For GCP IAM policies, it detects allUsers (public access), allAuthenticatedUsers (any Google account), and overpermissive built-in roles like roles/owner and roles/editor.
The analyzer applies the principle of least privilege: every permission should grant only what the identity needs to do its job. Wildcard permissions are the most dangerous because they implicitly grant future actions that each cloud provider may add to a service. Overpermissive scopes (Resource: *, AssignableScopes: /, allUsers) amplify the blast radius of any compromise. Conditions and binding-level controls narrow the effective permission set and should be applied to any high-privilege assignment.
How to export policy JSON: AWS: open the Console, navigate to IAM, open Policies, select a policy, then open the JSON tab; or run aws iam get-policy-version --policy-arn ARN --version-id v1. Azure: run az role definition show --name "RoleName". GCP: run gcloud projects get-iam-policy PROJECT_ID --format=json. The analyzer runs entirely in the browser and never sends your policy data to a server.