IAM Policy Example Library

Writing an IAM policy JSON document from a blank page for a common, well-understood access pattern — read-only S3 access, a Lambda execution role, deny-all — is unnecessary busywork you can skip. IAM Policy Example Library is a set of ready-to-use, structurally valid policy templates for frequently needed access patterns, each shown as pretty-printed JSON you can copy straight into the IAM console or your infrastructure-as-code.

Every template uses obvious placeholder values — <your-bucket-name>, <account-id>, <region>, <your-table-name> and similar — in angle brackets specifically so they cannot be mistaken for real values and are easy to find-and-replace before use. These are meant as a fast, correct starting point to edit, not a drop-in final policy: swap in your own resource identifiers, and narrow the action list further if a template grants more than a given role actually needs.

The two examples with the broadest reach — full S3 admin on a bucket, and full IAM admin — carry an explicit warning callout, since both are common sources of accidental over-permissioning when copied without a second look. Scope those down wherever possible; this site’s Least-Privilege Policy Generator and Overly-Permissive Policy Checker tools can help with that next step.

This is a curated set of common starting points, not exhaustive coverage of every access pattern you might need — for anything more specific, adjust the closest template here or build a policy from scratch with the IAM Policy Generator tool.

• 9 ready-to-use templates across S3, Compute, Database, IAM, and Messaging.
• Pretty-printed, valid JSON for every example, checked against the same validator used elsewhere in this suite.
• Category filter and live search.
• One-click copy of any example’s JSON.
• Explicit security warnings on the highest-privilege examples (IAM full admin, S3 full admin).
• Clearly marked placeholders — every bucket/table/account value is in angle brackets, impossible to mistake for a real value.
• 100% client-side — nothing you do here is uploaded.

1. Filter by category (S3 / Compute / Database / IAM / Messaging) or type a keyword to search.
2. Read the one-line description to confirm it matches what you need.
3. Copy the JSON with the copy button.
4. Replace every <placeholder> with your real bucket name, table name, ARN, region, or account id.
5. For the high-privilege examples, read the warning and consider narrowing the action list before attaching.

Example 1 — read-only S3 access. A role that only needs to list and read objects in one bucket copies the "S3 read-only access to a bucket" template, replacing <your-bucket-name> with the real bucket name.

Example 2 — a new Lambda function’s execution role. Attach the trust-policy example to the role so Lambda can assume it, then attach the permissions example (with the function name filled in) so it can write logs.

Example 3 — a guardrail deny. The deny-all statement is dropped into a larger SCP alongside a condition (e.g. aws:MultiFactorAuthPresent) to block all actions unless MFA is present.

• Faster than writing policy JSON from scratch for common access patterns.
• Structurally correct by construction — every example is validated before publishing.
• Placeholders that are impossible to miss, reducing the risk of accidentally shipping an unedited template.
• Flags the riskiest templates so you don’t attach broad access without noticing.
• Private — browsing and copying happen entirely client-side.