All Tools View Categories About Contact Privacy

IAM Policy to CloudFormation Converter

Convert IAM policy JSON into an AWS::IAM::Policy CloudFormation YAML resource.

Generates a starting-point YAML snippet — review and rename the placeholders before deploying. Runs entirely in your browser.

  

About IAM Policy to CloudFormation Converter

Turning an existing IAM policy JSON document into a CloudFormation resource means wrapping it in an AWS::IAM::Policy resource and deciding how to represent the PolicyDocument property. IAM Policy to CloudFormation Converter pastes your policy JSON and produces a ready-to-adapt YAML resource block, embedding the policy document as inline JSON — which CloudFormation accepts directly, since JSON is a valid subset of YAML — rather than attempting a full JSON-to-YAML block-mapping re-encoding that risks subtly altering a value along the way.

The output is a starting point: the resource's logical id, its PolicyName, and the role it attaches to are clearly labeled placeholders you should rename to match real resources in your template before deploying. The policy document itself is preserved exactly as pasted, pretty-printed, and indented to sit correctly under PolicyDocument:.

This tool emits the AWS::IAM::Policy (inline policy attached to one or more roles) shape by default, since it is the simplest complete example; if you need a standalone AWS::IAM::ManagedPolicy instead, the change is a one-line edit to the Type and the attachment property.

Features

  • Generates an AWS::IAM::Policy CloudFormation resource in YAML.
  • Embeds PolicyDocument as inline JSON — a robust, CFN-accepted pattern that preserves your policy exactly.
  • Custom logical id, policy name, and role reference fields.
  • Works on any valid JSON, with a structural warning if it does not look like a complete IAM policy.
  • One-click copy of the generated YAML.
  • 100% client-side — nothing is uploaded.

How to Use

  1. Paste your policy JSON, or click the sample.
  2. Set the logical resource id, policy name, and role reference (or leave the defaults).
  3. Click Convert to CloudFormation.
  4. Copy the YAML and rename the placeholders to fit your template before deploying.

Examples

Example. A simple S3 read-only statement converts into an ExamplePolicy resource of Type: AWS::IAM::Policy, attached via !Ref MyExampleRole, with PolicyDocument set to the pretty-printed JSON policy inline.

Benefits

  • Skips the manual reformatting of wrapping an existing policy in a CFN resource.
  • Preserves your policy exactly via inline JSON, avoiding any risk of a lossy YAML re-encoding.
  • Clearly labeled placeholders so you know exactly what to rename.
  • Private — conversion runs entirely in your browser.

Frequently Asked Questions

Is this generated CloudFormation ready to deploy as-is?
It is a reasonable starting point, not a guaranteed drop-in. The logical resource id, <code>PolicyName</code>, and the role it attaches to (<code>!Ref MyExampleRole</code>) are placeholders — rename them to match resources that actually exist in your template before deploying. Review the generated snippet like any other CloudFormation you didn't hand-write.
Why is <code>PolicyDocument</code> written as inline JSON inside YAML instead of proper YAML block mapping syntax?
CloudFormation accepts JSON as a valid value anywhere in a YAML template — JSON is a strict subset of YAML syntax. Embedding the policy as inline JSON under <code>PolicyDocument:</code> is the simpler and more robust choice: it reproduces your policy exactly, with zero risk of a hand-rolled JSON-to-YAML re-encoding subtly changing a value, at the cost of that one property looking visually different from the rest of the YAML file. This is a common, accepted pattern in real CloudFormation templates.
Does this use <code>AWS::IAM::Policy</code> or <code>AWS::IAM::ManagedPolicy</code>?
<code>AWS::IAM::Policy</code>, which attaches an inline policy directly to one or more Roles/Users/Groups referenced via <code>!Ref</code>. If you want a standalone reusable managed policy instead, change the <code>Type</code> to <code>AWS::IAM::ManagedPolicy</code> and adjust the <code>Roles</code>/<code>Users</code>/<code>Groups</code> properties accordingly — this tool emits the inline-policy shape since it needs no additional properties to be valid.
Does it validate that my JSON is a well-formed IAM policy first?
It only requires valid JSON to generate the CFN snippet. If the parsed JSON does not look like a complete IAM policy (missing <code>Version</code>, empty <code>Statement</code>, and similar) it still converts, but shows a structural warning above the output.
Is my policy JSON uploaded anywhere?
No — parsing and YAML generation both run entirely in your browser.