Cloud IAM Policy Analyzer

Paste an AWS IAM policy document and see what it actually permits. Wildcards get argued about in review; the finding this tool exists for does not, because privilege escalation lives in pairs of permissions that are unremarkable on their own. iam:PassRole permits nothing by itself — it only hands an existing role to a service. ec2:RunInstances permits nothing by itself — it only starts an instance. Together they are an instance the caller controls, running as the account’s most privileged role, with that role’s credentials readable from the metadata service. Fifteen documented paths are checked, each naming the exact permissions it needs and the route it takes. Action patterns are expanded as IAM wildcards first, so iam:* is recognised as granting iam:PassRole rather than missed as a different string. Deny statements are read and reported as narrowing, never as grants. Also covers Action * on Resource *, service wildcards and what each one includes, Allow with NotAction, and wildcard principals with and without a condition.