Visualize AWS IAM policies in your browser. No backend, no account, no telemetry.
🔗 Live: iamlens.dev
Paste an AWS IAM policy JSON and get three things:
- Visual graph — principals, actions, and resources rendered as a draggable React Flow graph so you can see the shape of permissions at a glance.
- Plain-English summary — what the policy actually grants, statement by statement.
- Risk audit — automated flags for the patterns that go wrong in production:
- Full administrative access (
Action: *+Resource: *) - Wildcard actions or resources used carelessly
NotAction/NotResourcewithAllow(almost always over-grants)- Public principals (
Principal: *) - Sensitive actions without
Conditiongating:iam:PassRole,sts:AssumeRole - Known privilege-escalation chains from the Rhino Security list
- Full administrative access (
The parser is hand-written TypeScript — deterministic, no LLM, no AWS SDK, no network calls. Your policy never leaves the browser.
Reading IAM policies as raw JSON is a pain, especially during audits or PR reviews. Existing tools either need AWS API access (Access Analyzer, Policy Simulator) or charge for it. I wanted something I could paste into and immediately see the shape of the permissions.
Short, opinionated guides to the IAM patterns that actually matter in production:
- How to read an IAM policy
- Allow vs Deny precedence
- Trust policies vs identity policies
- Why IAM wildcards are dangerous
- 10 IAM privilege escalation paths to know
- iam:PassRole, explained
- MFA enforcement patterns that actually work
- Reading CloudTrail for AccessDenied
- Next.js 16 with static export
- TypeScript (strict)
- React Flow (
@xyflow/react) for the graph - Tailwind CSS + shadcn/ui
- next-mdx-remote for the /learn content
- Vitest for the parser tests
- Cloudflare Pages for hosting
git clone https://github.com/pandalyt1c/iam-lens.git
cd iam-lens
npm install
npm run devThen open http://localhost:3000.
npm testThe parser test suite covers happy paths, malformed inputs, and risk-flag detection.
app/ Next.js routes (/, /learn, /learn/[slug])
components/ UI components (PolicyGraph, RiskFlags, etc.)
content/learn/ MDX articles for the learn section
lib/parser/ Hand-written IAM policy parser
├── types.ts Type definitions for parsed policies
├── parse.ts Top-level parser
├── normalize.ts Coerces single-vs-array fields to canonical form
├── analyze.ts Risk detection rules
├── summary.ts Plain-English summary generator
└── __tests__/ Vitest tests
Important: IAM Lens is a static reader, not a policy simulator. It can't tell you "if I attach this policy to user X, can they call s3:GetObject on bucket Y" — that requires the actual identity context, attached managed policies, SCPs, and permission boundaries.
For real simulation, use:
- AWS IAM Policy Simulator
cloud-copilot/iam-lens(different project, similar name — it's a CLI for actual simulation)
This tool answers a different question: "what does this single policy document grant, in isolation?"
Risk-rule suggestions, parser edge cases, and policy shapes that confuse the analyzer are all welcome. Open an issue with an example policy and I'll take a look.
MIT