AWS CDK IAM Construct Generator

AWS CDK IAM Construct Generator builds a real, reusable CDK TypeScript Construct class from your pasted policy JSON — not a bare PolicyDocument.fromJson(...) one-liner. It creates an iam.Role trusted by a service principal you choose, then maps every Statement in your policy to its own new iam.PolicyStatement({ effect, actions, resources }) call added to that role via role.addToPolicy(...).

Building with CDK's own PolicyStatement builder API — rather than embedding the whole document as an opaque JSON blob — is what makes the output a proper construct: something you can instantiate more than once, extend with typed props, or unit-test with the CDK assertions library, instead of a single static JSON dump. Effects map to iam.Effect.ALLOW/DENY, Action/Resource lists (whether written as a single string or an array in your JSON) become TypeScript string arrays, and any Condition block is passed straight through as the conditions property.

NotAction/NotResource statements are not silently guessed at — they are emitted as a commented-out TODO with the original statement JSON, since they need a different, lower-level CDK API to represent correctly. The construct class name and trust principal are the two things you choose; everything else is generated. This is still a starting point: review resource ARNs, action lists, and the trust relationship before deploying.

• Real CDK Construct class — export class ... extends Construct, not a bare snippet.
• Per-statement PolicyStatement mapping, not a single fromJson() call.
• iam.Role with a chosen service-principal trust relationship (EC2, Lambda, ECS tasks, and more).
• Condition blocks carried through to the conditions property.
• NotAction/NotResource flagged as a TODO instead of silently mis-converted.
• Works on any valid JSON, with a structural warning if it does not look like a complete IAM policy.
• One-click copy of the generated TypeScript.
• 100% client-side — nothing is uploaded.

1. Paste your policy JSON, or click the sample.
2. Set the construct class name.
3. Pick the trusted service principal for the role.
4. Click Generate CDK Construct.
5. Copy the TypeScript and review it — especially any NotAction/NotResource TODOs — before deploying.

Example. A two-statement policy (an S3 read Allow and a DeleteObject Deny) with "lambda" selected produces ExampleRoleConstruct, whose role trusts lambda.amazonaws.com, with two role.addToPolicy(new iam.PolicyStatement({...})) calls — one iam.Effect.ALLOW, one iam.Effect.DENY.

• A reusable construct, not a static blob — built with CDK's own builder API.
• Statement-by-statement fidelity, so each Allow/Deny is inspectable in code review.
• Flags what it can't safely convert instead of guessing.
• Real trust-policy generation for common AWS service principals.
• Private — generation runs entirely in your browser.