About AWS Policy Generator
AWS Policy Generator is a free AWS IAM policy generator and set of security tools. Build and check AWS IAM policies for Lambda, DynamoDB, EC2, ECS, Bedrock and other services, plus S3 bucket policies and multi-statement inline policies. Guides and worked examples also cover role trust policies and AWS Organizations service control policies.
Pick a service, choose actions, resources and conditions, and get policy JSON, or paste an existing policy to check its structure and get recommendations. Everything runs in your browser, and your policies are never sent to a server. A structure check is not AWS's validation: review what a policy grants and test it in your account before production. For background, see policies and permissions in the IAM User Guide.
Which tool do I need?
Start from what you are granting and to whom. The policy type decides where the document is attached and which elements it may contain, so it also decides the tool.
| You need to… | Policy type | Use |
|---|---|---|
| Give a role, user or group permissions for Lambda, DynamoDB, EC2, ECS, Bedrock and similar services | Identity policy | AWS Policy Generator (homepage) |
| Let a role read or write S3 objects (from the role's side) | Identity policy | Inline Policy Generator |
| Control who can access one bucket (other accounts, CloudFront, HTTPS only) | Bucket policy | S3 Bucket Policy Generator |
| Delegate IAM administration: creating roles, iam:PassRole, permissions boundaries | Identity policy (IAM actions) | IAM Policy Generator |
| Write a multi-statement policy, or edit an existing one as JSON | Identity policy | Inline Policy Generator |
| Let another account or an AWS service assume a role, or set an organization guardrail | Trust policy or SCP | Worked examples (no form editor) |
Who runs it
AWSPolicyGenerator.com is developed and operated by Aexena LLC, a New Jersey limited liability company. Questions and corrections reach Aexena LLC through the contact form.
Why it exists
Policy JSON is short, but getting it right requires knowing which actions an operation needs, which resource types they accept, which condition keys are present, and how AWS combines several policy types into one decision. Mistakes go both ways: policies that block legitimate work get “fixed” with wildcards, and wildcards are how over-permissioned roles become incidents. The site aims to make the precise version the easy one.
What you will find here
- Generators that assemble policy JSON from your choices, check its structure, and export it as Terraform, OpenTofu, CloudFormation, AWS CDK or Pulumi: the AWS Policy Generator, IAM Policy Generator, S3 Bucket Policy Generator and Inline Policy Generator.
- The Learning Center: 10 guides on policy design, evaluation, guardrails and validation.
- The example library: 15 worked examples with deployment steps, safe checks and common mistakes.
How the content is maintained
Aexena LLC maintains the generators, guides and examples, and publishes them under its own name rather than naming individual authors or reviewers. Guides and examples are written for this site from the official AWS documentation they link to; each shows when it was first published and when its content last changed, and a date changes only when the content does. A content audit on October 29, 2026 found errors in three guides and in several examples; they were corrected and the example library was rewritten. Automated tests run on every change: they check that every example policy is structurally valid for its policy type, that no example command deletes or disables anything, that guardrail exemptions are protected, that only AWS-documented placeholder identifiers are used, and that links resolve. The full process, and its limits, is described on the methodology page; every change to the site is listed in the changelog.
Your policies stay in your browser
The generators run entirely client-side. Policies, ARNs and account IDs you enter are not sent to our servers or to analytics. Analytics (only with your consent) records which tool was used and counts, never policy content. See the privacy policy.
Relationship to AWS
AWS Policy Generator is an independent project of Aexena LLC. Neither the site nor Aexena LLC is affiliated with, endorsed by or sponsored by Amazon Web Services. “AWS” and related names are trademarks of Amazon.com, Inc. or its affiliates. The authoritative reference for AWS behaviour is always the AWS documentation, and generated policies must be tested in your own AWS environment before use.
Contact
Found an error in a guide or example, or a bug in a generator? Please use the contact form; corrections are reflected in the changelog.