All Tools View Categories About Contact Privacy

Deny Policy Generator

Build an explicit IAM Deny statement, including the NotAction/NotResource "deny all except" pattern.

Runs entirely in your browser — nothing you enter is uploaded.
An explicit Deny always wins. If any policy attached to a principal — identity policy, permissions boundary, or resource policy — explicitly denies a request, it is denied, no matter how many Allow statements elsewhere grant it. (AWS Organizations SCPs and root-user behavior are separate mechanisms this tool does not model.)
0
statements
0
deny
-
field used
-
structurally valid

  

About Deny Policy Generator

An explicit Deny statement is the sharpest tool in IAM's policy language: it is the one thing that unconditionally overrides every Allow, from any policy, attached anywhere to the principal making the request. AWS evaluates every request the same way — deny by default, unless something explicitly allows it, unless something else explicitly denies it, in which case the deny wins regardless of how permissive everything else looks. Deny Policy Generator is a focused builder for that specific, high-leverage statement shape, including the two real branches its structure can take.

The base case is straightforward: pick a Sid, list the actions or resources you want to deny (one per line), and the tool assembles a statement with Effect: "Deny" and either an Action list (deny exactly these API calls, against any resource) or a Resource list (deny access to exactly these resources, for any action) depending on which target you choose. The second, more powerful branch is the NotAction/NotResource toggle. Flip it on while targeting actions, and the same list you entered becomes NotAction instead of Action — which inverts the match entirely: a Deny with NotAction: ["s3:GetObject", "s3:ListBucket"] denies every action whose name is not in that list, a common and deliberate pattern for expressing "deny everything except these specific safe actions" in one statement, rather than enumerating every dangerous action by hand. The same inversion applies to resources via NotResource when the target is set to Resource. This is real branching logic implemented in the statement builder, not a cosmetic label — the JSON field name and its semantics genuinely change based on the toggle.

An optional condition can scope the deny to specific circumstances rather than applying it unconditionally — a region restriction via StringNotEquals on aws:RequestedRegion, an IP restriction, a tag check, or any other IAM condition operator, key, and value you supply, assembled through the same condition-entry helper used across this tool category. Leaving the operator, key, or value blank simply omits the condition, producing an unconditional deny.

The documentation here is deliberately explicit about IAM's real evaluation order, because a wrongly-scoped Deny is one of the easiest ways to silently break access for an entire account: an explicit Deny in any policy attached to a principal — the identity policy, a permissions boundary, or (for resource-based access) the resource policy — beats every Allow, everywhere, with no way to override it from another policy. The only exceptions to this that exist in AWS are handled at the AWS Organizations level (Service Control Policies and resource control policies) and certain root-user behaviors, which this tool does not model or claim to account for — it builds a single, standard IAM policy statement and validates its structure, nothing more.

The result is a validated, ready-to-attach Deny statement, wrapped in a full policy document, with the NotAction/NotResource branch and any condition applied exactly as configured — assembled and checked entirely in your browser.

Features

  • Explicit Deny statement builder with a real Action-vs-Resource target choice.
  • NotAction/NotResource toggle that genuinely inverts the field, not a cosmetic label — implements the "deny everything except these" pattern.
  • Optional condition (operator, key, value) to scope the deny to specific circumstances.
  • Documents IAM's real evaluation order — explicit Deny always wins, with SCP/root nuances explicitly out of scope.
  • Structural validation of the assembled statement and document.
  • Pretty-printed JSON output with Copy and Download .json.
  • Two samples — a plain deny and a "deny all except" NotAction example.
  • One-click clear.
  • 100% client-side — nothing is uploaded.

How to Use

  1. Set a Sid (optional, for readability).
  2. Choose the target — Action or Resource.
  3. List the items to deny (or, with NotAction/NotResource, the items to exempt), one per line.
  4. Toggle "Deny all except listed" on if you want the inverted NotAction/NotResource behavior.
  5. Optionally add a condition to scope the deny.
  6. Click Build deny statement and check the structural validation result.
  7. Copy or download the JSON and attach it alongside your existing policies.

Examples

Example 1 — deny specific dangerous actions. Target Action, items iam:DeleteUser and ec2:TerminateInstances, toggle off — produces a plain Deny/Action statement blocking exactly those two calls everywhere.

Example 2 — deny all except safe read actions. Target Action, items s3:GetObject and s3:ListBucket, toggle on — produces Deny/NotAction, denying every action that is not one of those two.

Example 3 — protect a production bucket. Target Resource, item arn:aws:s3:::prod-bucket/*, toggle off — denies every action against that resource, regardless of what any Allow statement elsewhere grants.

Example 4 — deny outside an approved region. Target Action, item *, condition StringNotEquals / aws:RequestedRegion / us-east-1 — denies all actions whenever the request's region is not us-east-1.

Example 5 — sandbox-only access. Target Resource, item arn:aws:s3:::sandbox-bucket/*, toggle on (NotResource) — denies access to every resource except objects in the sandbox bucket.

Benefits

  • Gets the Deny-always-wins semantics right by construction, not just by explanation.
  • Real NotAction/NotResource branching for the common "deny all except" allowlist pattern.
  • Optional condition scoping instead of an unconditional deny by default.
  • Honest about AWS's evaluation nuances it does not model (SCPs, root user).
  • Structural validation before you attach the statement.
  • Private — nothing entered ever leaves your browser.

Frequently Asked Questions

Does an explicit Deny always win, even over an Allow in a different policy?
Yes, with essentially no exception you should rely on. AWS's IAM evaluation logic is: default deny, unless an applicable statement explicitly allows the request, <em>and</em> no applicable statement explicitly denies it — an explicit <code>Deny</code> anywhere in any policy attached to the principal (identity policy, permissions boundary, or resource policy) overrides every <code>Allow</code>, no matter how many other statements or policies grant that access. The only nuances outside this — AWS Organizations Service Control Policies, resource control policies, and root-user-specific behavior — are account/org-level mechanisms this tool does not model; it only builds a standard IAM policy statement.
What does the NotAction toggle actually do?
It is a real structural switch, not cosmetic. With the toggle off, the list you enter becomes the <code>Action</code> field directly: "deny exactly these actions." With the toggle on for the Action target, the same list becomes <code>NotAction</code> instead, and the statement denies <em>every action except</em> the ones listed — a common and powerful pattern for statements like "deny everything except read access," since <code>NotAction</code> combined with <code>Deny</code> means "match every action name that is NOT in this list."
Is NotAction with Deny the same thing as an Allowlist?
It approximates one, but as a Deny statement it still needs to coexist with an actual Allow statement elsewhere granting the safe actions — a <code>Deny</code>/<code>NotAction</code> statement alone does not grant anything; it only removes access to everything not on its list, assuming something else already allowed those actions.
Can I target resources with NotResource the same way?
Yes — switching the target to "Resource" and enabling the toggle produces <code>NotResource</code> instead of <code>Resource</code>, denying access to every resource except the ones listed (for whatever actions the statement covers).
Why would I add a condition to a Deny statement?
Conditions scope a Deny to specific circumstances instead of applying it unconditionally — for example, denying an action only outside an approved AWS region (<code>StringNotEquals</code> on <code>aws:RequestedRegion</code>), or only when a specific tag is absent. Without a condition, the statement denies unconditionally whenever its Action/Resource match.
What condition operators are offered?
A single optional condition per statement, with operator, key, and value fields — commonly StringEquals, StringNotEquals, StringLike, IpAddress, NotIpAddress, Bool, or any other IAM condition operator you type in. Leaving operator, key, or value blank omits the condition entirely.
Does this validate that my Deny statement combined with existing Allow statements produces the access I expect?
No — this tool builds one statement in isolation and checks that it is structurally valid IAM JSON. It does not simulate your account's full policy set or predict the net effect against other policies; use the IAM Policy Simulator on AWS's own console, or the Policy Impact Simulator tool in this category if you want to test how a statement interacts with others.
Can I set both Action and NotAction on the same statement?
No — IAM does not allow both on one statement, and this tool enforces that by construction: choosing "Action" as the target with the toggle off sets only <code>Action</code>; toggling NotAction sets only <code>NotAction</code>, never both at once.
Is anything I enter sent anywhere?
No — the whole assembly, including the deny list and condition, happens locally in your browser.