AWS IAM Policy Generator

An IAM (Identity and Access Management) policy is a JSON document that defines permissions in AWS. It specifies what actions are allowed or denied, on which resources, and under what conditions. Policies are attached to IAM users, groups, or roles to grant or restrict access.

By default everything is denied. Allow explicitly permits an action. Deny explicitly blocks it and overrides any Allow. If multiple policies apply, an explicit Deny always wins — even if another policy allows the same action. Use Deny sparingly, usually for security guardrails.

The wildcard '*' means all resources of the matched type. For example, Action: s3:ListBucket with Resource: '*' allows listing all S3 buckets. For tighter security, specify exact ARNs like arn:aws:s3:::my-specific-bucket.

An Amazon Resource Name (ARN) uniquely identifies any AWS resource. Format: arn:partition:service:region:account-id:resource. For example, arn:aws:s3:::my-bucket or arn:aws:lambda:us-east-1:123456789012:function:my-function. S3 bucket ARNs omit region and account ID.

Conditions add extra constraints to when a policy applies. Common examples: aws:SourceIp to restrict by IP range, aws:SecureTransport to require HTTPS, aws:RequestedRegion to restrict to specific AWS regions, aws:MultiFactorAuthPresent to require MFA.

Least privilege means granting only the minimum permissions required to perform a task. Instead of s3:* (all S3 actions), grant only the specific actions needed — e.g., s3:GetObject and s3:ListBucket. This limits the blast radius if credentials are compromised.