IAM Sensitive Action Flagger

IAM Sensitive Action Flagger scans a pasted policy for individually high-impact actions — destructive operations, credential-issuing operations, and audit-disabling operations — drawn from a curated reference catalog, and reports each match with its risk level and the specific reason it is considered sensitive. Unlike a wildcard scanner, this looks at the actual action names granted (wildcard-aware) rather than just flagging * patterns, so a narrowly-written but still dangerous grant like iam:CreateAccessKey is caught even without any wildcard in sight.

Each catalog entry carries a fixed risk tier — critical, high, or medium — reflecting the action's typical blast radius: critical for account-wide or irreversible actions (full iam:*, disabling CloudTrail), high for serious but more contained actions (deleting a specific bucket, issuing one user's keys), and medium for actions that are risky in the wrong hands but often legitimately required (sts:AssumeRole). These tiers are fixed properties of the catalog entry, not computed from how tightly your specific policy scopes the Resource field — a s3:DeleteBucket grant is shown as "high" whether it targets one named bucket or every bucket in the account.

The catalog is intentionally curated and non-exhaustive: it covers commonly cited high-impact IAM actions, not every action that could ever matter in a given context. Absence from this list does not mean an action is safe — it means this tool does not specifically call it out. The full catalog is shown below the results, so you can see everything this tool checks for, even before pasting a policy.

• 20 curated high-impact actions checked automatically, wildcard-aware.
• Critical / high / medium risk tiers with a plain-English reason per match.
• Results grouped and sorted by risk level, most severe first.
• Summary stat row — count by risk level, up top.
• Full reference catalog expandable below the results, visible even before you paste anything.
• 100% client-side — nothing is uploaded.

1. Paste an IAM policy document, or click the sample to load a policy with several sensitive grants.
2. Click Flag.
3. Check the summary stat row for a quick count by risk level.
4. Review each match, grouped by risk, with its reason.
5. Expand the reference catalog to see every action this tool checks for, regardless of match.

Example 1 — direct match. A policy granting s3:DeleteBucket → flagged high: "Permanently deletes an S3 bucket."

Example 2 — wildcard grant catches multiple entries. A policy granting iam:* → matches every iam: catalog entry at once, including the critical-tier full-iam:* entry itself.

Example 3 — nothing sensitive. A policy granting only s3:GetObject → no matches; a clear "no sensitive actions from this catalog were found" message is shown, not silence.

• Catches specific dangerous actions, not just broad wildcards.
• Risk-tiered and reasoned — not just a flat list of names.
• Transparent catalog — see exactly what is and is not checked.
• Private — the policy never leaves your browser.