Paste an AWS IAM policy, see exactly what it grants — and get plain-English
findings for wildcards, missing Condition blocks, and privilege-escalation
paths like unconditioned iam:PassRole.
Live: https://yousafkhamza.github.io/iam-visualizer/
IAM policies are easy to write and hard to read back. A policy that looks
fine in a code review — Action: "s3:*", Resource: "*" — hides how much
access it actually grants until someone traces it by hand. This renders the
policy as statement cards with color-coded risk, so the blast radius is
obvious at a glance.
- Full wildcard action + wildcard resource → high risk
- Wildcard action (
service:*) or wildcard resource with no scoping → review - Sensitive actions (
iam:PassRole,iam:CreateAccessKey,sts:AssumeRole,kms:Decrypt, …) granted without aConditionblock → review or high risk - Scoped actions/resources or a present
Conditionblock → looks scoped
The rule set lives in src/lib/analyze.ts — it's intentionally small and
readable rather than exhaustive; PRs adding rules are welcome.
Everything runs client-side. No policy JSON leaves the browser.
Vite + React + TypeScript, no backend, deployed via GitHub Actions to GitHub Pages.
npm install
npm run devPush to main — .github/workflows/deploy.yml builds and publishes to
Pages automatically. First-time setup: in the repo's Settings → Pages,
set Source to "GitHub Actions".
If you fork this under a different repo name, update base in
vite.config.ts to match.