IAM Policy Variable Syntax Checker

IAM policy variables — placeholders like ${aws:username} that AWS substitutes at evaluation time — are a small piece of syntax with two easy ways to get wrong: typing a variable name that does not exist or is misspelled, and simply forgetting the closing brace, which turns a working policy into one with a literal, useless ${aws:usern string sitting in a Resource ARN. IAM Policy Variable Syntax Checker catches both classes of mistake by scanning pasted text for every ${...} token, reporting each one's name and whether it matches a curated list of common AWS policy variables, and separately flagging any unclosed ${ that never found its matching brace.

The scan itself works directly on the raw text you paste — a full policy document or just a Resource/Condition snippet — using a token-matching pass that finds every substring starting with ${ and ending at the next }. For each token found, the text between the braces is extracted as the variable's name and checked against a curated list of roughly a dozen common IAM policy variable prefixes: the identity variables aws:username and aws:userid; the tag-based families aws:PrincipalTag/, aws:RequestTag/, and aws:ResourceTag/, matched as prefixes so any tag name after the slash is accepted; the EC2-specific ec2:SourceInstanceARN and ec2:ResourceTag/; and the federation variables saml:sub, saml:aud, saml:namequalifier, oidc:sub, and oidc:aud used in SAML- and OIDC-federated identity policies. Each token is reported with its full literal text, its extracted name, and a known/unknown badge.

As with the other tools in this category that use a curated reference list, "unknown" is scoped honestly: AWS documents additional policy variables beyond this list, particularly newer or less common federation and service-specific variables, and this tool does not claim to enumerate all of them. A variable flagged unknown may be a real, valid AWS policy variable this tool simply was not built to recognize — treat it as a prompt to check AWS's policy-variable reference, not as a confirmed mistake. Where this tool is unambiguous, and where it earns its keep, is the unclosed-brace check: an unclosed ${ is a hard syntax defect regardless of which variable was intended. It happens most often from a stray backspace while editing a long Resource ARN, or from copy-pasting a partial line. The check counts every ${ occurrence in the text and compares it against the number of complete, properly-closed ${...} tokens found; any shortfall is reported as an unclosed-brace count, prompting you to scan the raw text for the dangling ${ AWS's own policy validation would otherwise reject (or, worse, silently treat as a literal string that never resolves to anything useful) at attach time.

This tool does not evaluate or substitute variables — it never tries to compute what ${aws:username} would actually expand to for a specific caller, and it does not check whether a given variable makes semantic sense in the specific field it appears in (a variable is scanned for wherever it shows up in the text, Resource, Condition, or anywhere else). It is a fast, local, honest first pass over the syntax layer only: does this token look like a real variable name, and is every brace properly closed.

The included sample deliberately includes one known variable (${aws:username} inside a Resource ARN, the single most common real-world use of policy variables — scoping each caller to their own S3 prefix) and one made-up, unknown variable, so loading it demonstrates both outcomes side by side without having to write your own test case first.

• Finds every ${...} token anywhere in the pasted text.
• Curated list of ~12 common AWS policy variable prefixes, including tag-based prefix matching.
• Per-token results table — full token, extracted name, known/unknown badge.
• Unclosed-brace detection — flags any ${ with no matching }.
• Works on a full policy or a bare snippet.
• Honest scope — "unknown" never means "invalid".
• Repeated-variable counting — every occurrence is its own row.
• Sample input with one known and one unknown variable.
• One-click clear.
• 100% client-side — nothing is uploaded.

1. Paste a policy document or a Resource/Condition snippet, or click the sample.
2. Click Check variables.
3. Review the summary — total tokens found, known vs. unknown, and any unclosed-brace warning.
4. Scan the table for unknown variable names.
5. If an unclosed-brace warning appears, search the raw text for a stray ${.
6. Fix and re-check.

Example 1 — known variable in a Resource ARN. arn:aws:s3:::my-bucket/${aws:username}/* reports aws:username as known.

Example 2 — known tag-prefix variable. ${aws:PrincipalTag/department} reports as known, matched via the aws:PrincipalTag/ prefix.

Example 3 — unknown variable. ${made:UpVariable} reports as unknown — not in the curated list.

Example 4 — unclosed brace. arn:aws:s3:::my-bucket/${aws:username/* (missing the closing }) reports an unclosed-brace count of 1, alongside whatever complete tokens were found elsewhere in the text.

Example 5 — no variables at all. A policy with no ${...} tokens anywhere reports zero variables found and zero unclosed braces.

• Catches a genuinely silent failure mode — an unclosed ${ that becomes a useless literal string.
• Flags likely typo'd variable names for a second look.
• Never overclaims — "unknown" is presented as a coverage gap, not a verdict.
• Works on full documents or bare snippets.
• Fast local first pass before deeper documentation review.
• Private — pasted text never leaves your browser.