Before an IAM policy can be attached at all, it needs to have the minimal shape IAM requires: a recognized Version, a non-empty Statement array, and every statement carrying a valid Effect, an action field, and a target field. IAM Policy Structure Validator paste a policy JSON document and it checks exactly that — nothing more, nothing less — reporting a clear pass or fail with every specific structural problem listed.
The checks are the same structural rules IAM itself enforces on document shape before it even gets to evaluating what the policy grants. Version must be present and must be one of the two recognized values, 2012-10-17 (current) or 2008-10-17 (legacy) — anything else, including a missing field entirely, is an error. Statement must be present and must not be an empty array; a policy with no statements has nothing to evaluate and is not a usable document. Each individual statement is then checked on its own: it must have an Effect that is exactly Allow or Deny (not any other casing or value), it must have an Action or a NotAction field, and it must have one of Resource, NotResource, Principal, or NotPrincipal — the last two accounting for resource-based policy statements like S3 bucket policies or IAM role trust policies, which commonly identify a principal rather than a resource.
When the document is valid, the tool shows a clear pass result along with the statementCount — the total number of statements found — so the shape of what you just validated is visible at a glance without counting manually. When it is not valid, every specific problem is listed individually rather than stopping at the first one found: a missing Version, an empty Statement array, and a specific statement missing its Effect can all be reported together in one pass, so you can fix everything at once instead of re-running after each individual fix.
This tool is deliberately narrow and single-purpose. It does not attempt JSON syntax diagnosis beyond a plain "could not parse as JSON" message when the pasted text is not valid JSON at all — no line or column number, no attempt to guess where the syntax broke. That level of diagnosis is exactly what the separate IAM Policy JSON Syntax Validator tool in this category is built for, and this tool assumes you are pasting syntactically valid JSON and simply wants to know whether its structure is sound. It likewise does not check policy size against IAM's character-count quotas, does not look for duplicate statements, overly permissive Action/Resource combinations, or wildcard usage — each of those has its own dedicated, focused tool in this category. Keeping each tool to one job means the result here is exactly what it claims to be: a structural pass/fail with an itemized error list, nothing conflated with unrelated checks.
Structural validity here means the document has the shape IAM requires to be considered at all — it does not mean the policy is safe, well-scoped, free of duplicate statements, or within size limits; those are separate questions this tool intentionally does not answer. Everything runs locally in your browser the moment you paste a document or click the sample; nothing you paste is ever sent anywhere.