AWS IAM Policy Validator

An IAM (Identity and Access Management) policy is a JSON document that defines permissions in AWS. It specifies what actions are allowed or denied, on which resources, and under what conditions. Policies are attached to IAM users, groups, or roles. There are two types: identity-based policies (attached to a principal) and resource-based policies (attached to a resource like an S3 bucket or KMS key). Every API call in AWS is evaluated against the applicable policies before being allowed.

Action: '*' grants ALL permissions across ALL AWS services — this is equivalent to root access. If an IAM entity with Action: '*' is compromised, the attacker can create new admin users, delete data, spin up infrastructure, exfiltrate secrets, and more. Always replace Action: '*' with the specific actions your application actually needs. Use IAM Access Analyzer and CloudTrail to discover the minimum set of permissions actually used.

Privilege escalation occurs when an attacker uses existing limited permissions to grant themselves or another principal higher permissions. Common escalation paths: iam:CreateAccessKey (create new credentials for an existing admin user), iam:AttachUserPolicy (attach an existing admin policy to a controlled user), iam:UpdateLoginProfile (set a password on an admin account). AWS security researchers have documented over 20 escalation paths. Audit these actions carefully and require MFA conditions.

Least privilege means granting only the minimum permissions required to perform a task. Instead of ec2:* (all EC2 actions), grant only the specific operations needed — e.g. ec2:StartInstances and ec2:StopInstances. This limits the blast radius if credentials are compromised. Tools to help: IAM Access Analyzer generates least-privilege policies from CloudTrail logs, and the AWS Policy Simulator lets you test what permissions a policy actually grants.

Conditions add extra constraints to when a statement applies. Common examples: aws:MultiFactorAuthPresent (require MFA), aws:SourceIp (restrict by IP or CIDR range), aws:RequestedRegion (limit to specific AWS regions), aws:SecureTransport (require HTTPS), aws:CalledVia (restrict to actions called through specific services). Conditions are a powerful way to harden permissive policies — for example, allowing s3:* only from a specific VPC endpoint.

Managed policies are standalone policy documents that can be attached to multiple users, groups, or roles. AWS provides pre-built managed policies (like AmazonS3ReadOnlyAccess), or you can create customer managed policies. Inline policies are embedded directly into a single IAM entity and are deleted when that entity is deleted. Best practice: prefer customer managed policies over inline policies for reusability, version history, and easier auditing. Avoid AWS managed policies for production — they tend to be overly broad.