IAM Policy Statement Duplicate Detector

Policies assembled by merging JSON snippets from multiple sources, or built by copy-pasting an existing statement as a starting point for a new one, frequently end up with two statements that are byte-for-byte identical — same Effect, same Action, same Resource, same everything. Policy Statement Duplicate Detector paste a policy JSON document and it finds every exact duplicate statement pair, telling you which statement index is the original and which is the redundant copy.

The comparison is a deep, exact-content check: each statement's keys are normalized to a consistent order and compared as JSON, so two statements are only flagged as duplicates when their Effect, Action (or NotAction), Resource (or NotResource), Sid, Condition, and every other field match exactly. This is deliberately conservative — it finds statements that are truly redundant (removing the later copy changes nothing about what the policy allows or denies) rather than statements that merely look similar or grant overlapping access.

There is one limitation worth being upfront about, because it is easy to assume the tool catches more than it does: array element order matters to the comparison. A statement with "Action": ["s3:GetObject", "s3:ListBucket"] and another with "Action": ["s3:ListBucket", "s3:GetObject"] grant identical permissions in practice, but this tool does NOT flag them as duplicates, because the underlying check compares the JSON content as-is, including array ordering, rather than treating arrays as unordered sets. The same applies to Resource arrays. If a policy was assembled by hand and you suspect there may be near-duplicates that differ only in list ordering, a manual side-by-side read is still worth doing — this tool's guarantee is specifically about exact, literal duplicates, not semantically-equivalent-but-reordered ones.

When duplicates are found, each is reported as a pair: the index of the first (earliest) occurrence and the index of the later, redundant occurrence. If the identical statement content appears three or more times, every later occurrence is paired against that same first occurrence, so a triple-duplicate shows up as two separate pairs rather than being silently collapsed or missed. Because an exact duplicate by definition grants nothing its twin does not already grant, removing every "duplicate" side of a reported pair is always safe from a permissions standpoint — it only shrinks the document and improves readability, which also helps if the policy is close to one of IAM's character-count size limits (see the separate IAM Policy Size Checker tool in this category for that).

This tool is intentionally narrow: it does not detect statements that are merely redundant in effect but different in content (e.g. one statement's Resource being a superset of another's), does not rewrite or merge your policy, and does not call any AWS API. It runs the comparison entirely in your browser the moment you paste a document or click the sample, and nothing you paste is ever sent anywhere.

• Finds exact duplicate statements anywhere in a multi-statement policy.
• Reports first-vs-duplicate index pairs so you know which copy to remove.
• Handles 3+ repeats of the same statement as multiple pairs against the earliest occurrence.
• Deep, order-sensitive comparison of every field, including Sid and Condition.
• Honest about its own limitation — does not flag array-order-only differences (documented clearly, see FAQ).
• Clear "no duplicates found" result when the policy is clean, not just an empty table.
• Sample policy with a deliberate duplicate to see a real positive result immediately.
• Clear JSON parse errors if the pasted text is not valid JSON.
• 100% client-side — nothing is uploaded.

1. Paste your policy JSON, or click "Load sample".
2. Click Find duplicates.
3. If duplicates are found, review each first/duplicate index pair shown.
4. Compare the shared statement JSON shown for each pair to confirm it is truly redundant.
5. Remove the later (duplicate) statement from your policy source.
6. Re-run to confirm the document is now clean.

Example 1 — obvious copy-paste duplicate. Two identical {"Effect":"Allow","Action":"s3:GetObject","Resource":"*"} statements at index 0 and index 2 — flagged as a pair (first: 0, duplicate: 2).

Example 2 — same statement 3 times. A policy with the identical Deny statement appearing at index 1, 4, and 7 reports two pairs: (first: 1, duplicate: 4) and (first: 1, duplicate: 7).

Example 3 — array-order limitation. "Action": ["s3:GetObject", "s3:ListBucket"] vs "Action": ["s3:ListBucket", "s3:GetObject"] in otherwise identical statements — functionally identical, but NOT flagged, per the documented limitation.

Example 4 — similar but not identical. One statement allows s3:GetObject on arn:aws:s3:::bucket/* and another allows s3:GetObject on arn:aws:s3:::bucket (no trailing /*) — these differ in Resource and are correctly NOT flagged.

Example 5 — clean policy. A policy where every statement covers a distinct service or resource pattern reports zero duplicate pairs, shown as a clear positive result.

• Finds redundant statements that bloat a policy without adding any permission.
• Safe to act on — an exact duplicate by definition changes nothing when removed.
• Helps trim documents that are close to an IAM size limit.
• Honest about scope — clearly documents what it does and does not catch.
• Instant, local feedback — no waiting on an API call.
• Private — policy content never leaves your browser.