IAM Policy Permission Explainer

Reading raw IAM policy JSON to understand what a statement actually grants means mentally parsing Effect, Action or NotAction, Resource or NotResource, an optional Principal, and an optional Condition block all at once — tedious even for a short policy, and error-prone for a long one. IAM Policy Permission Explainer takes one pasted policy document and turns every statement into a single plain-English sentence, so you can read down the list instead of parsing brackets.

The explanation is entirely template-based string generation, not an AI summary: each sentence is assembled directly from the JSON fields of that one statement using fixed rules — "Grants" for Allow, "Denies" for Deny, the Action or NotAction list joined with commas, "on" followed by the Resource or NotResource list, an optional "for principal ..." clause, and an optional "only when ..." clause built from the Condition block. Nothing is inferred beyond what the statement's fields literally say, and nothing is sent to any model — it is deterministic, rule-based code you can read in the shared engine source.

Because each sentence describes one statement on its own, this tool does not answer "is this specific action on this specific resource actually allowed" — that depends on every statement in the policy (and any other attached policies) being evaluated together against one concrete request, which is exactly what the separate IAM Policy Simulator tool is for. What this tool gives you is the fast, honest first pass: what does each individual statement, read literally, say it does.

• One plain-English sentence per statement, generated from the policy JSON.
• Covers Action/NotAction, Resource/NotResource, Principal, and Condition fields.
• Rule-based, not AI — deterministic string templates, explicitly documented as such.
• Sample policy to see the tool in action immediately.
• 100% client-side — nothing is uploaded.

1. Paste a policy document or click the sample.
2. Click Explain.
3. Read the numbered list — one sentence per statement, in document order.
4. For a decision on one specific action + resource combined across the whole policy, use the IAM Policy Simulator instead.

Example 1 — simple Allow. { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::b/*" } → "Statement 1 (Allow): Grants s3:GetObject on arn:aws:s3:::b/*."

Example 2 — Deny with a condition. A Deny statement with a Bool condition on aws:MultiFactorAuthPresent → the sentence ends with "...only when aws:MultiFactorAuthPresent Bool false."

Example 3 — NotAction. A statement using NotAction is rendered as "...every action EXCEPT ..." to make the exclusion explicit.

• Faster policy review — read sentences instead of parsing JSON by eye.
• Nothing hidden — every sentence maps directly to fields actually present in the statement.
• Explicitly not AI — deterministic and reproducible, same input always gives the same sentences.
• Private — everything stays in your browser.