How do I check if an IAM policy is too permissive?

Paste the policy and the analyzer flags over-permissive patterns: Action "*" (full admin), service wildcards like s3:*, Resource "*", privilege-escalation actions, and mutating statements with no Condition. Each finding is graded by blast radius and rolled into an A to F least-privilege grade.

What IAM privilege escalation actions does it detect?

It flags known privilege-escalation actions such as iam:PassRole, iam:AttachRolePolicy, iam:PutUserPolicy, iam:CreatePolicyVersion, iam:CreateAccessKey, sts:AssumeRole on a wildcard resource, and lambda:UpdateFunctionCode, which let a principal gain more access than intended.

How do I find unused IAM permissions?

Generate a report with "aws iam generate-service-last-accessed-details --arn " to get a JobId, then fetch it with "aws iam get-service-last-accessed-details --job-id " and paste the JSON. The analyzer compares granted services against AWS Access Advisor last-used dates and flags anything unused past a threshold so you can remove it.

How is the least-privilege grade calculated?

The grade is a 0 to 100 score mapped to an A to F letter. Each finding subtracts points weighted by severity, so critical issues like full admin or privilege escalation drop the grade fastest. A clean, tightly scoped policy scores an A.

How do I scope down an over-permissive IAM policy?

The analyzer produces a scoped-down policy you can copy: it removes services proven unused from Access Advisor data and narrows a bare Action "*" to the services actually observed in use. It also lists what to tighten by hand, such as replacing Resource "*" with specific ARNs.

Which compliance controls do the findings map to?

Each finding maps to the control language it puts at risk across SOC 2 (CC6.1, CC6.3, CC6.6), CIS AWS Foundations (1.16), ISO 27001:2022 (A.8.2, A.5.15, A.5.18), HIPAA (164.312(a)(1)), and GDPR (Art. 5(1)(c)), so you can attach IAM findings to an audit or access review.

What is ClickOps and why does the tool ask how the policy was created?

ClickOps means changes made by clicking in the AWS console instead of through infrastructure-as-code and review. Permissions granted via ClickOps are ungoverned and tend to be over-scoped, so the answer changes the recommendation: scope and codify a ClickOps policy, or tighten and open a pull request for an IaC policy.

Free tool

See what your IAM policy never needed.

Name: ops0
Author: ops0

Paste one AWS IAM policy. ops0 flags over-permissive grants, privilege-escalation paths, and unused permissions, then hands you a scoped-down policy. Nothing is uploaded.

100% client-side

No signup

Nothing uploaded

Least-privilege in seconds

Open on desktop

Pasting your IAM policy and AWS CLI output needs a real keyboard. Open this page on a desktop browser to run the analyzer.

IAM policy JSON

How was this created?

Prove unused permissionsoptional

Run this for the role or user (swap in its ARN), then paste the JSON output:

aws iam generate-service-last-accessed-details --arn <role-or-user-arn> --query JobId --output text | xargs -I{} aws iam get-service-last-accessed-details --job-id {}

100% in your browser. Your policy is never uploaded. Open DevTools then Network and see for yourself.

{ }

Paste a policy and hit Analyze. A risk grade, findings, and a scoped-down policy show up here.

What it checks

An IAM policy analyzer built for least-privilege access.

Over-permissive grants and wildcards

Action "*" full admin, service wildcards like s3:*, and Resource "*" that grant far more than any workload needs.

IAM privilege escalation

iam:PassRole, sts:AssumeRole, iam:AttachRolePolicy, and other actions that let a principal gain more access than intended.

Unused permissions

Paste AWS Access Advisor last-accessed data to flag services granted but never used, then remove them.

Missing conditions

Mutating statements with no source IP, VPC, MFA, or tag guardrails limiting when the access applies.

Least-privilege grade and scoped policy

An A to F least-privilege score plus a scoped-down policy you can copy or commit as code.

Compliance mapping

Every finding mapped to SOC 2, CIS AWS Foundations, ISO 27001:2022, HIPAA, and GDPR control language for audits.

How it works

From one pasted policy to a scoped fix.

Paste one policy

Drop an AWS IAM policy or trust policy. It never leaves your browser, so pasting is safe.

Say how it was made

ClickOps or IaC. That one answer decides whether the fix is codify-and-scope or tighten-and-PR.

Read the risk

Over-broad grants, privilege-escalation paths, and missing conditions, ranked by blast radius.

Prove what is unused

Add Access Advisor data and heuristic findings become proven "unused, remove it" with a scoped policy to copy.

Common questions

Yes. This IAM policy analyzer runs entirely in your browser. Your policy JSON and Access Advisor data are never uploaded to any server, so you can paste them safely. You can confirm this in your browser DevTools Network tab.

Snapshot vs continuous

This tool is the snapshot. ops0 is the control.

This free tool

Point-in-time check on a policy you paste
No AWS login, no analyzer to enable, no per-role cost
Runs in your browser, nothing is uploaded
Grade, findings, compliance mapping, and a scoped-down policy

ops0, continuous

Proves usage continuously across every principal from live access data
Watches every account and role, not one pasted policy
Routes the scoped fix through policy, approval, pull request, and audit
Turns a point-in-time grade into enforced least privilege

This checks one policy.
ops0 proves it across every principal.

ops0 reads live access data continuously, proves which permissions each role actually uses, and routes the scoped-down fix through policy, approval, pull request, and audit.

Why ops0