About aws-iam.io

A free tool that turns boto3 Python code into a least-privilege AWS IAM policy — so you don't have to guess which permissions your code actually needs.

What it does

aws-iam.io reads the boto3 (AWS SDK for Python) calls in the code you paste and derives the AWS IAM actions those calls require. Instead of attaching broad, catch-all policies to a role or user, you get a policy scoped to what your code actually calls — the core idea behind the least-privilege security model.

Paste your code, hit Generate IAM Policy, and get a ready-to-use JSON policy document you can attach to any IAM role or user.

Why we built it

Writing IAM policies by hand is tedious and error-prone. The common shortcut — attaching a managed policy like AmazonS3FullAccess or, worse, *:* — works, but it violates the principle of least privilege and expands the blast radius if credentials ever leak. Deriving the policy directly from the code that will run closes that gap without slowing anyone down.

Current scope

Today, aws-iam.io supports Python (boto3) only, using a rule-based approach: it derives each IAM action by pattern-matching the AWS service and method name in your code, without calling any AWS API or executing your code. See the boto3-to-IAM action reference for known cases where this derivation doesn't match the exact IAM action name, and our FAQ for more detail. Support for additional languages and SDKs is planned.

Privacy

We don't execute or store the code you paste beyond what's needed to process your request. See our Privacy Policy for details.

Try the generator