Policy input
Or load a built-in sample
Fictional policies (AWS example account 111122223333). Loading one fills the box and runs the normal local analysis - including the coverage panel. One is an obvious escalation; the rest look dangerous but are neutralized by an explicit Deny, a boundary shape, or an unsupported shape the analyzer fails closed on.
Analysis coverage
What this analysis did and did not cover. A clean parse is not a complete conclusion, and unsupported does not mean safe.
Findings
The findings table is the authoritative view and works without the graph.
Attack-path graph
Visual aid only. Every edge also appears in the findings table above. Select an edge to inspect the evidence behind it.
Export
About this tool
IAM Blast Radius maps the potential blast radius of a single AWS IAM policy - privilege-escalation paths, role-assumption reach, sensitive-data access, and broad-resource grants - analyzed entirely in your browser, with every finding graded by certainty.
It is a free tool that needs no sign-up, no AWS credentials, and no installation - it runs as static files in a modern web browser with JavaScript enabled.
Supported policy families
The analyzer auto-detects the policy family from the document shape (paste-and-go; you can also
set the family manually). This phase fully evaluates identity-based policies.
Auto-detect keys off the presence of a Principal or NotPrincipal element:
resource-based and role-trust shapes (and any NotPrincipal,
ambiguous, or mixed shape) carry that element, so they are detected and fail closed -
the tool reports a coverage state rather than presenting findings for a shape it does not yet model.
Permissions-boundary, SCP, and session policies carry no Principal
and are indistinguishable from an identity policy by shape alone; on the paste-and-go path they are
labeled Identity policy and evaluated with identity rules, unless you set that family manually
in the selector, which then fails closed. A resource control policy (RCP) is the
exception in that group: like a resource-based policy, an RCP carries a Principal element
(the default RCPFullAWSAccess uses "Principal": "*"), so by shape it is
detected as a resource policy and fails closed - it is never labeled an identity
policy on paste-and-go. NotPrincipal and other recognized-but-unmodeled
elements are rejected with a machine-readable code and the exact JSON path, never silently ignored.
Coverage behavior
Every run produces an analysis-coverage summary shown above the findings: the detected family, how many statements were accepted or rejected, unrecognized actions, unsupported conditions or elements, the AWS evaluation layers this single document did not cover, whether the graph is complete or truncated, and the rule and action-catalog versions. A clean JSON parse is not a complete conclusion, and unsupported does not mean safe: an element the tool cannot model prevents a complete conclusion rather than clearing the policy.
Limitations
- It reads one policy document. It shows the potential blast radius of that policy, not a principal's account-wide permissions, which AWS computes from identity, resource, and trust policies, permission boundaries, SCPs, and session policies together.
- It never contacts AWS and uses no credentials, so it cannot see whether a passable or assumable target role actually exists, what that role can do, or how service and trust configuration would gate a path. Those are reported as unknown, never inferred.
- Conditions are classified by how the text reads (narrows / selects / broadens / context-required). The tool does not simulate a request context and never claims a live AWS request would be allowed or denied.
- The action catalog is a small, curated, dated snapshot of the services the rules reason about, not the full AWS service reference. Actions outside it are reported as unknown in coverage, not dropped and not treated as safe.
Privacy boundary
The analysis runs entirely in your browser. The shipped JavaScript contains no network calls -
no fetch, no background upload, no analytics - so pasted policy content is not sent
anywhere by the page, and a strict Content-Security-Policy is layered on top as defense in depth.
Policy content is not written to local storage, session storage, or cookies. The "Clear analysis"
button and leaving the page both wipe the in-memory state.
Examples
Built-in sample policies (fictional, using AWS example account 111122223333) load into the input and run the normal local analysis, including the coverage panel. One is an obvious escalation; the others look dangerous but are neutralized by an explicit Deny, a permissions-boundary shape, or an unsupported shape the analyzer fails closed on - useful for seeing when the tool declines to fire.
Rule catalog
Capability rules flag wildcard actions and resources, direct IAM administration, destructive
action families, data exfiltration and KMS decryption, and detection impairment. Escalation rules
correlate action combinations into privilege-escalation paths: iam:PassRole into a
workload-execution service (Lambda, EC2, and peers), policy-version manipulation, attach/put policy
to self, trust-policy modification, credential creation, and AssumeRole expansion. Each finding
carries its evidence, a split policy-evidence / path-exploitability certainty, the limitation of
what it does not prove, and a remediation. The rule catalog and the action catalog are independently
versioned and their versions are shown in the coverage panel and in every export.
How it differs from AWS Access Analyzer and Policy Simulator
AWS IAM Access Analyzer and the AWS IAM Policy Simulator are AWS services that reason against your live account context - resolving effective policies, resource and trust relationships, and organization controls on AWS's side. IAM Blast Radius is a static, client-side, single-document analyzer. It never calls AWS, needs no credentials, and does not resolve account-wide outcomes; it maps the potential blast radius of the one policy you paste and is complementary to, not a replacement for, those AWS tools.