AWS IAM Policy Generator
Choose Allow or Deny, pick a service and tick the actions you need, add the resource ARNs, and copy a valid IAM policy document. Presets cover S3, DynamoDB, Lambda, SQS, SNS, EC2, CloudWatch Logs and Secrets Manager, and a custom mode accepts any service:Action. The generator warns about wildcard permissions, non-ARN resources and the classic S3 ListBucket versus object ARN mix-up.
Reviewed by Vincenzo Manto, Founder & Lead Developer · Last updated September 30, 2026
How it works
- 1
Choose the effect (Allow or Deny) and the AWS service for each statement.
- 2
Tick the actions you need and list the resource ARNs, one per line.
- 3
Resolve any warnings, then copy the JSON into the IAM console, Terraform or CloudFormation.
Example
Effect: Allow
Service: Amazon S3
Actions: GetObject, PutObject
Resource: arn:aws:s3:::my-bucket/*{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject", "s3:PutObject"],
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}Anatomy of an IAM policy
An IAM policy is a JSON document with a Version and one or more statements. Each statement has an Effect, the Actions it applies to, and the Resources it covers, and may include an optional Sid and Conditions. An explicit Deny always overrides an Allow, and anything not explicitly allowed is denied by default.
Writing safer policies
Start from the smallest set of actions, then add more only when you see AccessDenied errors in logs. Scope resources to specific ARNs instead of *, prefer separate statements for read and write, and add Conditions such as source IP or MFA where possible. Review the result with IAM Access Analyzer before attaching it to a role.
Frequently asked questions
Why does S3 need two different ARNs?
s3:ListBucket acts on the bucket itself, so it needs arn:aws:s3:::my-bucket, while object actions like GetObject and PutObject act on objects and need arn:aws:s3:::my-bucket/*. Listing both ARNs, or using two statements, avoids AccessDenied errors.
What does least privilege mean?
Grant only the actions a workload really uses, on only the resources it touches. Avoid Action * with Resource *, because a leaked credential then controls the whole account.
Does this tool access my AWS account?
No. It only produces JSON text in your browser. It does not connect to AWS or need any credentials, so you must validate the policy in IAM Access Analyzer or the policy simulator.
Is the action list complete?
The presets list the most common actions. For anything else use the extra actions box and write the full service:Action name, for example ec2:RunInstances.