How to use the AWS IAM Policy Generator
- 1. Choose effect and actionsPick Allow or Deny and type actions such as s3:GetObject, one per line.
- 2. Add resource ARNsList the exact ARNs, and add a condition if access should be limited.
- 3. Copy the policyPaste the JSON into IAM, then test it in the policy simulator.
What the default example produces
The starting values build a read-only policy for one S3 bucket. The output contains "Version": "2012-10-17", a statement with Sid ReadReportsBucket, Effect Allow, the actions s3:GetObject and s3:ListBucket, and two resources: the bucket ARN arn:aws:s3:::reports-bucket and the object ARN ending in /*. Both are needed because ListBucket applies to the bucket itself while GetObject applies to the objects inside it.
If you list only the /* ARN with a List action, the generator warns you, because that mistake is one of the most common reasons an S3 policy appears not to work.
Writing least-privilege policies
- Name exact actions.
s3:*or*grants far more than most apps need. - Name exact resources. A Resource of * covers every resource of that type in the account.
- Add conditions such as requiring MFA for sensitive actions, limiting to an office IP range, or allowing only one Region.
- Remember explicit Deny wins. A Deny in any applicable policy overrides every Allow.
The tool checks the format of each action and ARN, but it does not know whether an action name really exists or whether your account's other policies change the outcome. Test the result with the IAM policy simulator or IAM Access Analyzer before you attach it. For bucket-level rules, use the S3 bucket policy generator.
Frequently asked questions
What is 2012-10-17 in the Version field?
It is the current version of the IAM policy language, not a date you should change. The older 2008-10-17 version lacks features such as policy variables.
Is an IAM policy the same as a bucket policy?
No. An IAM policy is attached to a user, group or role. A bucket policy is attached to the bucket and names a Principal.
Is the AWS IAM Policy Generator free?
Yes, the AWS IAM Policy Generator is free. The first time you generate your first policy, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.