Free IAM Policy Linter

Paste an AWS IAM policy below to instantly check it for common structural risks — wildcard actions, service-wide grants, privilege-escalation-capable permissions, NotAction traps, wildcard resources, and public principals. It runs entirely in your browser: nothing is uploaded, nothing is logged.

Runs entirely in your browser. Nothing is sent anywhere or logged. These are quick static checks — for AI-Powered reasoning and a fixed policy, use the full analyzer below.

What this checks (and what it doesn't)

This linter applies fast, deterministic static rules. It is great for a quick gut-check, but it does not reason about how permissions combine across statements, accounts, or services. For that — plus a plain-English explanation and a corrected policy — use Shieldly's AI-Powered analyzer. It is also free and needs no signup for the demo.

Want to understand a specific risky permission? The IAM privilege escalation reference breaks down each escalation path, and the IAM glossary defines the core concepts.

Embed this on your site

Writing a tutorial or post about IAM? Embed this exact linter — same engine, runs entirely in the reader's browser, nothing sent to us:

<iframe
  src="https://www.shieldly.io/embed/iam-policy-linter"
  width="100%"
  height="600"
  style="border: 1px solid #333; border-radius: 8px;"
  title="Shieldly IAM Policy Linter"
></iframe>

Get AI-Powered analysis + the fix

The full analyzer explains why each finding matters and returns a tightened policy in seconds. Free, no signup. Also ships as CLI, VS Code extension, GitHub Action, and CDK Guard.

Amazon Web Services (AWS) is a trademark of Amazon.com, Inc. Shieldly is not affiliated with, endorsed by, or sponsored by Amazon Web Services.