All Tools View Categories About Contact Privacy

IAM Policy to CDK Converter

Convert IAM policy JSON into an AWS CDK TypeScript snippet using PolicyDocument.fromJson().

Generates a starting-point TypeScript snippet — review and rename the placeholders before deploying. Runs entirely in your browser.

  

About IAM Policy to CDK Converter

Migrating an existing IAM policy document into an AWS CDK app usually means deciding how to represent it in code. IAM Policy to CDK Converter pastes your policy JSON and produces a TypeScript snippet using iam.PolicyDocument.fromJson(...) — the simplest, most robust pattern for embedding an already-resolved static policy, since JSON syntax is directly valid as a TypeScript object literal and needs no re-derivation into a sequence of new iam.PolicyStatement({...}) builder calls.

The output wraps the parsed document in a small ManagedPolicy construct as a complete, runnable example, with the construct id, variable name, and managedPolicyName clearly labeled as placeholders you should rename to fit your actual CDK app before deploying. Only TypeScript is generated; if you need Python, Java, or C#, treat the printed JSON as the source of truth and port the call to your language's CDK equivalent by hand.

Because this tool only converts a static, already-resolved JSON policy, it has no way to know which values in your policy should become dynamic CDK tokens (e.g. a bucket ARN available only at synth time) — that kind of reference needs to be added by hand after conversion.

Features

  • Generates a TypeScript CDK snippet using iam.PolicyDocument.fromJson(...).
  • Wraps the result in a complete ManagedPolicy construct example.
  • Custom variable name and managed policy name fields.
  • Works on any valid JSON, with a structural warning if it does not look like a complete IAM policy.
  • One-click copy of the generated code.
  • 100% client-side — nothing is uploaded.

How to Use

  1. Paste your policy JSON, or click the sample.
  2. Set the CDK variable name and managed policy name (or leave the defaults).
  3. Click Convert to CDK.
  4. Copy the TypeScript and rename the placeholders to fit your app before deploying.

Examples

Example. A simple S3 read-only statement converts into import * as iam from 'aws-cdk-lib/aws-iam'; const policyDocument = iam.PolicyDocument.fromJson({ ... }); const examplePolicy = new iam.ManagedPolicy(this, 'ExamplePolicy', { managedPolicyName: 'example-policy', document: policyDocument });.

Benefits

  • Skips the manual reformatting of translating an existing policy into CDK's builder API.
  • Uses the simplest, most robust embedding patternfromJson(), not a hand-rolled per-statement translation.
  • Clearly labeled placeholders so you know exactly what to rename.
  • Private — conversion runs entirely in your browser.

Frequently Asked Questions

Is this generated CDK code ready to use as-is?
It is a reasonable starting point, not a guaranteed drop-in. The construct id, the variable name, and <code>managedPolicyName</code> are placeholders you should rename to fit your own CDK app before deploying. Review the generated snippet like any other CDK code you didn't hand-write.
Why <code>iam.PolicyDocument.fromJson(...)</code> instead of building each statement with <code>new iam.PolicyStatement({...})</code>?
Because your pasted JSON is already a complete, resolved policy document, <code>fromJson()</code> lets you embed it directly as a TypeScript object literal — JSON syntax is valid TypeScript object-literal syntax — without re-deriving each statement into a builder call. That makes it the simplest and most robust conversion path when you are migrating an existing static policy rather than authoring a new one statement-by-statement in CDK's fluent API.
Only TypeScript, or is Python supported too?
Only TypeScript is generated. A Python (or Java/C#) variant is not provided by this tool — if you need one, port the printed <code>fromJson(...)</code> call (or the underlying JSON) to your language's CDK equivalent by hand.
Does this handle CDK tokens or references, like a bucket ARN that only exists at synth/deploy time?
No. This converts a static, already-resolved policy JSON document into a static CDK snippet. If part of your policy needs to reference another construct's attribute dynamically (e.g. <code>bucket.bucketArn</code>), you will need to edit the generated object by hand to replace the relevant string with that reference — the converter cannot infer which values should become CDK tokens.
Does it validate that my JSON is a well-formed IAM policy first?
It only requires valid JSON to generate the snippet. If the parsed JSON does not look like a complete IAM policy (missing <code>Version</code>, empty <code>Statement</code>, and similar) it still converts, but shows a structural warning above the output.
Is my policy JSON uploaded anywhere?
No — parsing and code generation both run entirely in your browser.