All Tools View Categories About Contact Privacy

CloudFormation IAM Template Generator

Generate a complete CloudFormation template with an IAM role, attached policy, and outputs.

Generates a starting-point template — review and rename the placeholders before deploying. Runs entirely in your browser. 

  


  




      

      
      

      
      

        
 About CloudFormation IAM Template Generator

        
CloudFormation IAM Template Generator produces a complete, ready-to-review CloudFormation template — not a single bare resource snippet. Paste your policy JSON and it generates the full AWSTemplateFormatVersion, a Parameters section (a RoleName parameter), a Resources section containing an AWS::IAM::Role with an AssumeRolePolicyDocument for a chosen AWS service principal plus the attached policy carrying your JSON, and an Outputs section exporting the role's ARN and name.
The policy document is embedded as inline JSON under PolicyDocument:, which CloudFormation accepts directly since JSON is a valid subset of YAML — the simplest, most robust way to reproduce your policy exactly without a lossy JSON-to-YAML re-encoding.
You can choose between an inline AWS::IAM::Policy attached to the role (the default) or a standalone AWS::IAM::ManagedPolicy. Every logical id, parameter default, and policy name is a clearly labeled placeholder to review and rename before deploying.

      

      

      
      

        
 Features

        
  • Complete template — AWSTemplateFormatVersion, Parameters, Resources, and Outputs, not a lone snippet.
  • AWS::IAM::Role with a generated AssumeRolePolicyDocument for a chosen service principal.
  • Toggle between an inline AWS::IAM::Policy and a standalone AWS::IAM::ManagedPolicy.
  • Outputs section exporting the role ARN and name via !GetAtt/!Ref.
  • PolicyDocument embedded as inline JSON — exact, robust, no lossy re-encoding.
  • One-click copy of the generated YAML.
  • 100% client-side — nothing is uploaded.

      

      

      
      

        
 How to Use

        
  1. Paste your policy JSON, or click the sample.
  2. Set the role and policy logical ids and policy name.
  3. Pick the trusted service principal for the role's trust policy.
  4. Optionally check "standalone ManagedPolicy" instead of an inline policy.
  5. Click Generate Template.
  6. Copy the YAML and review the placeholders before deploying.

      

      

      
      

        
 Examples

        
Example. A simple S3 read-only statement with "lambda" selected produces a full template whose ExampleRole trusts lambda.amazonaws.com, an ExamplePolicy resource carrying the S3 statement, and an Outputs.RoleArn exporting !GetAtt ExampleRole.Arn.

      

      

      
      

        
 Benefits

        
  • A whole template, ready to review — not an isolated resource you have to wire up yourself.
  • Real trust-policy generation for common AWS service principals.
  • Preserves your policy exactly via inline JSON.
  • Clearly labeled placeholders so you know exactly what to rename.
  • Private — generation runs entirely in your browser.

      

      

      
      
      

        
Frequently Asked Questions

        

          
          

            Is this a complete, deployable CloudFormation template?
            
It is a complete template structurally — <code>AWSTemplateFormatVersion</code>, <code>Parameters</code>, <code>Resources</code>, and <code>Outputs</code> are all present and internally consistent — but the role name default, logical ids, and policy content are placeholders. Review it like any other CloudFormation you didn't hand-write before deploying.

          

          
          

            Why is <code>PolicyDocument</code> written as inline JSON inside YAML?
            
CloudFormation accepts JSON anywhere in a YAML template, since JSON is a strict subset of YAML syntax. Embedding the policy as inline JSON reproduces it exactly, with no risk of a hand-rolled JSON-to-YAML re-encoding subtly changing a value — a common, accepted pattern in real CloudFormation templates.

          

          
          

            AWS::IAM::Policy or AWS::IAM::ManagedPolicy — what is the difference, and which does this generate?
            
By default this generates <code>AWS::IAM::Policy</code>, an inline policy attached directly to the generated role. Check "Generate as a standalone AWS::IAM::ManagedPolicy" to instead generate a reusable managed policy (with a <code>ManagedPolicyName</code>) that could in principle be attached to multiple roles — the template still attaches it to the one role it creates as a working example.

          

          
          

            Which service principals are available for AssumeRolePolicyDocument?
            
EC2, Lambda, ECS tasks, Step Functions (states), Glue, and EKS. For a cross-account or SAML/OIDC federated trust policy, use the dedicated IAM Trust Policy Generator or Federated Identity Trust Policy Generator tools instead.

          

          
          

            Does it validate that my JSON is a well-formed IAM policy first?
            
It only requires valid JSON to generate the template. If the parsed JSON does not look like a complete IAM policy (missing <code>Version</code>, empty <code>Statement</code>, and similar) it still generates the template, but shows a structural warning above the output.

          

          
          

            Is my policy JSON uploaded anywhere?
            
No — parsing and YAML generation both run entirely in your browser.

          

          
        

      

      

      
      
        



  
Related Tools

  

    
    
      

        
      

      

        
ARN Builder

        AWS IAM ARN Tools
      

    
    
    
      

        
      

      

        
Bulk ARN Parser

        AWS IAM ARN Tools
      

    
    
    
      

        
      

      

        
ARN Comparison Tool

        AWS IAM ARN Tools
      

    
    
    
      

        
      

      

        
Cross-Account ARN Generator

        AWS IAM ARN Tools
      

    
    
    
      

        
      

      

        
ARN Parser

        AWS IAM ARN Tools
      

    
    
    
      

        
      

      

        
ARN to Resource Type Identifier

        AWS IAM ARN Tools