Free AWS AssumeRole Chain Visualizer

Role chaining is how one over-trusted role quietly becomes account admin: role A can assume role B, which can assume role C. Paste the trust policies of the roles you care about below and see every assumable path — external entry points, multi-hop chains, cycles, wildcard principals, and cross-account :root trusts missing sts:ExternalId.

Runs entirely in your browser. Nothing is sent anywhere or logged. Reads the trust-policy side only — actually assuming a role also requires sts:AssumeRole in the caller's identity policy. Principals are matched literally (no wildcard expansion) and Condition keys are listed, not evaluated.