Start free
FREE TOOL

AWS IAM Permissions Finder

Find the IAM actions an AWS CLI command or SDK call needs, get a least-privilege policy, and see why an AccessDenied error happened.

  • Your data never leaves your browser: everything is calculated by JavaScript on this page, not on a server.
  • Nothing you enter is uploaded, processed on a server or stored. Check it in your browser's developer tools (Network tab).

Command, SDK call or AccessDenied

An AWS CLI command, a boto3 or JavaScript SDK v3 call with its client or import line, or the whole AccessDenied error message.

Your account optional

Used in the resource ARNs of the policy; "*" when empty.

How it works →AccessDenied explained →
See result ↓

Policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket/reports/2026.csv"
    }
  ]
}
IAM policies and their evaluation are core AWS Solutions Architect Associate exam topicsTry free SAA-C03 practice questions with answers and explanations.SAA-C03 questions →

How the permissions are found

Every AWS API call is authorized by one or more IAM actions, and they are not always named like the call: aws lambda invoke needs lambda:InvokeFunction, CompleteMultipartUpload needs s3:PutObject, and RunInstances can also need iam:PassRole and ec2:CreateTags. The finder reads this from the AWS Service Reference, the machine-readable version of the Service Authorization Reference, which your browser loads straight from AWS: the current list of actions, resources and ARN formats for over 400 services.

  • Always needed - the action that authorizes the operation itself.
  • Needed with certain parameters - other actions AWS lists for the operation: s3:GetObjectVersion when a version ID is given, iam:PassRole when an instance gets a role. Tick them to add them to the policy.
  • Resources - the ARN formats of the action, filled with the names in the command (bucket, key, table, function, queue) and the account and Region you enter; anything not given is *.

The high-level aws s3 commands - cp, sync, mv, rm, ls - make several API calls each; the finder knows which. sync, for example, lists both buckets, so it needs s3:ListBucket on the bucket and s3:GetObject or s3:PutObject on the objects - two statements, because the bucket and its objects have different ARNs.

Reading an AccessDenied error

Most AWS services say in the error which policy denied the request, in the form User: ARN is not authorized to perform: ACTION on resource: ARN because .... The end of the message decides where the fix goes:

The message ends withWhere to fix it
because no identity-based policy allowsAdd an Allow to a policy of the user or role
because no resource-based policy allowsAdd the principal to the bucket, key, secret or queue policy
because no role trust policy allowsAdd the principal to the trust policy of the role being assumed
because no permissions boundary allowsAllow the action in the boundary set on the user or role
because no session policy allowsCreate the session without the session policy, or with the action in it
because no service control policy allowsThe organization's management account has to allow it in an SCP
because no VPC endpoint policy allowsAllow the action in the policy of the VPC endpoint
with an explicit deny in ...Find and narrow the Deny statement - no Allow can override it

An assumed-role session such as arn:aws:sts::111122223333:assumed-role/app-role/i-0abc123 is the role arn:aws:iam::111122223333:role/app-role: fix the role's policies, and name the role in a resource or trust policy. Amazon S3's plain Access Denied without details usually means a bucket policy, Block Public Access, a KMS key policy or object ownership; check the bucket's policy and encryption first.

Frequently asked questions

Is the command or the error sent anywhere?

No. Your browser downloads AWS's public permission list of the service from AWS and matches the text against it; nothing you enter is uploaded, processed on a server or stored - AWS only sees which service's list was downloaded. The page only counts that the finder was used, with what kind of input and for which service, never the text.

Is the generated policy least privilege?

It contains only the actions the call needs, on the resources the call names. Where the command gives no name, the ARN has a * - replace it with the real name to narrow the policy further. Conditions (tags, encryption, source IP) are yours to add.

Why does a command not show up?

AWS does not yet list the permissions of every operation in the Service Reference, and some AWS CLI commands (aws cloudformation deploy, aws eks get-token) are built from several API calls. For these, the Service Authorization Reference lists the actions per service.

References

Simplified AWS service information for programmatic access
Troubleshoot access denied error messages
Policy evaluation logic