Wildcard permissions
Flags Action "*", service-wide wildcards like s3:* and wildcard Resource "*" that remove your blast-radius limits.
IAM policy scanner
Free AWS IAM policy scanner
Paste or upload an AWS IAM policy and get an instant risk report. AutoCloudPilot checks for wildcard permissions, privilege-escalation paths, sensitive actions, missing guardrail conditions and public trust policies, then scores the policy from 0 to 100. No signup, nothing stored.
New analysis
Analyze an IAM policy
Paste policy JSON or upload a .json file. Everything runs in memory and nothing is stored.
What it checks
What the IAM policy scanner checks
Every policy is reviewed against a set of least-privilege and privilege-escalation rules.
Privilege escalation
Detects dangerous combinations such as iam:PassRole with lambda:CreateFunction, ec2:RunInstances or Step Functions.
Sensitive actions
Highlights identity, KMS, S3, logging and secrets actions such as iam:CreateAccessKey, kms:PutKeyPolicy or secretsmanager:GetSecretValue.
Missing conditions
Points out sensitive permissions granted with no MFA, source-IP, external-ID or organization guardrail.
Public trust policies
Detects resource policies with a wildcard Principal "*" that let any AWS account assume a role.
Structure & managed policies
Validates Version, Effect, Action and Resource, and warns about broad managed policies such as AdministratorAccess.
How it works
How the IAM policy scan works
Paste or upload the policy
Drop in the policy JSON from the IAM console, the AWS CLI or your IaC repository. No account connection or credentials are needed.
We run static rules
The analyzer parses the statements and applies wildcard, escalation, condition, trust and structure rules entirely in memory.
Get a scored report
Findings are grouped by severity and category with the exact statement, evidence, a 0-100 score and the specific fix.
Who it's for
Least-privilege reviews without the guesswork
Cloud & platform teams
Review new roles and policies before they ship, and catch over-permissioning at code-review time.
Security & auditors
Produce a clear, defensible snapshot of why a policy is risky and what to change for least privilege.
Developers
Quickly sanity-check the inline policies and trust policies you generate for apps, jobs and CI pipelines.
FAQ
AWS IAM policy scanner FAQ
Is the AWS IAM policy scanner free?
Yes. The AutoCloudPilot IAM policy scanner is completely free, requires no signup, and you can analyze as many policies as you like.
Does the scanner store my policy?
No. The policy is analyzed in memory and nothing is stored or shared. Only paste policy JSON — never include credentials, secrets or access keys.
What does the IAM policy scanner check?
It flags wildcard actions and resources, privilege-escalation combinations such as iam:PassRole with Lambda or EC2, sensitive actions, missing MFA or network conditions, public trust policies and broad managed policies, then scores the policy from 0 to 100.
What policy formats are accepted?
A single IAM policy document, a bare list of statements, a list of policy documents, or a list of managed policy ARNs. JSON from the IAM console, the AWS CLI or get-policy is all supported.
Is this a substitute for an IAM access analyzer?
No. This is a fast static best-practice review. For data-driven least privilege, combine it with AWS IAM Access Analyzer and real CloudTrail usage.
Which services does it understand?
The rule set focuses on the highest-impact actions across IAM, STS, Organizations, S3, KMS, Secrets Manager, SSM, CloudTrail, GuardDuty, EC2, Lambda, RDS, DynamoDB and more.
Also try
Free website security scanner
Check TLS/SSL, security headers, cookies, DNS and email security, exposure files and more. Run a free, passive scan of any website you own.
Want to monitor IAM continuously?
This analyzer reviews one policy document at a time and does not connect to a cloud account. Multi-account scanning and finding correlation are planned separately.