IAM Policy Wildcard Usage Analyzer

Wildcards are one of the most common sources of unintended over-permissioning in IAM policies, but not all wildcards carry the same risk — a bare "*" is categorically different from a scoped prefix pattern like "s3:Get*". Wildcard Usage Analyzer paste a policy JSON document and it finds every wildcard occurrence across Action, NotAction, Resource, and NotResource in every statement, grading each one on a three-tier risk scale so you can review the ones that matter most first.

The grading logic is simple and consistent regardless of which field the wildcard appears in. A bare "*" with nothing else is graded high risk — it matches literally everything, no scoping at all. A service-level wildcard, meaning a service prefix followed by exactly :* and nothing more ("s3:*", "ec2:*", "iam:*"), is graded medium risk — it grants every action within one entire service, which is often far more than intended. Everything else containing a * character — a prefix wildcard like "s3:Get*" covering a family of related read actions, or a Resource ARN pattern like "arn:aws:s3:::my-bucket/*" scoping to everything under one bucket — is graded low risk, since these are meaningfully narrower than either of the other two tiers even though they still use pattern matching.

Every finding is reported individually with the statement index it came from, which field it appeared in (Action, NotAction, Resource, or NotResource), the exact wildcard value as written, and its risk tier shown as a colored badge — red for high, amber for medium, blue for low — so a long finding list can be visually triaged at a glance. A summary count at the top breaks down how many findings fall into each of the three tiers, giving an immediate sense of the overall wildcard exposure of the document before reading any individual row.

It is worth being clear about what this tool is not: it is not a verdict that every wildcard found is wrong. Wildcards are a normal and often necessary part of well-written IAM policies — a prefix pattern covering a family of read-only actions, or a Resource ARN scoped to everything inside one specific bucket, are both reasonable, common patterns that happen to use the * character while still being meaningfully scoped. The value of this tool is surfacing every occurrence with a consistent risk grade so you can deliberately review the small number of high- and medium-risk wildcards first, rather than either ignoring wildcards entirely or treating every prefix pattern as equally alarming. This tool also does not overlap with the narrower Overly Permissive Policy Checker in this category, which answers one specific yes/no question (does an Allow statement combine a bare Action "*" with a bare Resource "*"); this tool instead lists every individual wildcard occurrence on its own, whether or not it happens to pair with another wildcard in the same statement.

This is a purely local, static analysis of the pattern text in the JSON you paste — it does not have a catalog of real IAM action names per service, does not check whether a wildcard actually resolves against anything in a real AWS account, and does not call any AWS API. Everything runs in your browser the moment you paste a document or click the sample; nothing you paste is uploaded.

• Scans Action, NotAction, Resource, and NotResource across every statement.
• Three-tier risk grading — high (bare "*"), medium (service-level "svc:*"), low (prefix/ARN patterns).
• Colored risk badges for fast visual triage of a long findings list.
• Per-finding statement index, field, and exact wildcard value.
• Summary counts per risk tier shown at the top.
• Clear "no wildcards found" result when the policy is clean, not just an empty table.
• Sample policy covering all 3 risk tiers to see the grading in action immediately.
• Clear JSON parse errors if the pasted text is not valid JSON.
• 100% client-side — nothing is uploaded.

1. Paste your policy JSON, or click "Load sample".
2. Click Analyze.
3. Check the summary counts for how many high/medium/low risk wildcards were found.
4. Review high-risk (bare "*") findings first, then medium (service-level).
5. For each finding, note the statement index and field to locate it in your source.
6. Narrow the wildcard where it is not actually needed, then re-run to confirm.

Example 1 — high risk. "Action": "*" — a bare wildcard, graded high.

Example 2 — medium risk. "Action": "s3:*" — every S3 action, graded medium.

Example 3 — low risk action prefix. "Action": "s3:Get*" — a family of read actions, graded low.

Example 4 — low risk resource pattern. "Resource": "arn:aws:s3:::my-bucket/*" — everything under one bucket, graded low.

Example 5 — multiple wildcards in one statement. A statement with "Action": ["s3:*", "s3:Get*"], "Resource": "*" produces three separate findings: one medium (s3:*), one low (s3:Get*), and one high (Resource "*") — each listed on its own row.

• Surfaces every wildcard, not just the most obvious bare "*" case.
• Risk-graded so the most dangerous patterns are easy to prioritize.
• Covers all 4 relevant fields — Action, NotAction, Resource, NotResource.
• Fast visual triage via colored badges.
• Instant, local feedback — no waiting on an API call.
• Private — policy content never leaves your browser.