AWS SAM Template IAM Policy Generator

AWS SAM Template IAM Policy Generator produces the Policies: section of an AWS::Serverless::Function resource in two modes. SAM Policy Templates mode lets you pick from a curated list of real, published SAM policy templates — S3ReadPolicy, S3CrudPolicy, DynamoDBReadPolicy, DynamoDBCrudPolicy, SQSPollerPolicy, CloudWatchPutMetricPolicy, and more — fill in the one or two parameters each requires (like a bucket or table name), and get the correct YAML with zero hand-written IAM JSON. This is the AWS-recommended approach for common access patterns.

Custom policy mode takes a full IAM policy document you paste and embeds its Statement array as inline JSON directly under Policies:, alongside a Version line — SAM accepts a complete IAM policy document object as a Policies list entry, not only a template name or managed policy ARN. This gives full control for anything a template does not cover: multiple resources, explicit Denies, custom Conditions, or actions no template exposes.

Both modes produce a starting-point Resources.MyFunction snippet with placeholder Handler/Runtime values — merge the Policies: block into your real function's properties.

• SAM Policy Templates mode — curated, name-verified templates with their required parameters.
• Custom policy mode — paste any IAM policy JSON, embedded inline under Policies:.
• One toggle switches between the two modes without losing your input.
• Parameter placeholders so you always get valid YAML even before filling every field.
• Works on any valid JSON in custom mode, with a structural warning if it does not look like a complete IAM policy.
• One-click copy of the generated YAML.
• 100% client-side — nothing is uploaded.

1. Choose a mode — SAM Policy Templates or Custom policy.
2. Templates mode: pick a template from the dropdown and fill in its parameter(s).
3. Custom mode: paste your policy JSON, or click the sample.
4. Click Generate.
5. Copy the YAML and merge the Policies: block into your real function.

Example 1 — template mode. Picking S3ReadPolicy with bucket name my-bucket produces Policies: - S3ReadPolicy: BucketName: my-bucket.

Example 2 — custom mode. Pasting a policy with an S3 read statement produces Policies: - Version: '2012-10-17' Statement: [{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}].

• Points you to the simpler AWS-recommended approach first, with custom JSON as a fallback.
• Correct SAM template names and parameters, not guessed.
• Preserves custom policies exactly via inline JSON.
• Private — generation runs entirely in your browser.