🔍 Understand what an AWS IAM policy can actually do.
AWS Policy Explorer is a client-side web application for exploring and analyzing AWS IAM policies. It helps security professionals move beyond raw policy JSON and identify effective permissions, dangerous combinations, wildcard expansion, and potential privilege-escalation paths.
The application connects directly from your browser to AWS APIs. Credentials are not sent to Cyfinoid servers or stored by the application.
With AWS Policy Explorer, you can:
✅ Browse AWS-managed and customer-managed IAM policies
✅ Analyze a policy directly using its ARN
✅ Expand full and partial IAM action wildcards into effective permissions
✅ Detect more than 70 privilege-escalation and shadow-admin patterns across multiple AWS services
✅ Compare different versions of the same IAM policy side by side
✅ Review policy JSON alongside visual and security-focused analysis
✅ Identify dangerous permission combinations that may be missed during manual review
✅ Work in limited-permission mode when the supplied identity cannot list every policy
Why it stands out:
🧠 Converts complex IAM documents into usable security findings
🔐 Runs client-side and communicates directly with AWS
📊 Combines policy browsing, version comparison, permission expansion, and risk analysis
⚡ Requires no backend deployment
Use credentials only for AWS accounts that you own or are explicitly authorized to assess. Temporary credentials with the minimum required permissions are recommended.
Check it out: https://cyfinoid.github.io/cloud-iam-policy-explorer/
Source Code: https://github.com/cyfinoid/cloud-iam-policy-explorer