IAM Unused Permissions Finder

IAM Unused Permissions Finder compares what an IAM policy grants against a list of actions you already know are genuinely used, and reports every granted action that is not covered by anything on that list. This is a fast way to spot candidates for permission trimming when you are working toward least privilege — paste the policy, paste (or type) the actions you have confirmed are actually exercised, and see the gap.

This is a purely syntactic, client-side comparison of two lists you provide. It does not connect to CloudTrail, IAM Access Analyzer, or any other AWS service — it has no independent knowledge of what has actually been used in your account. A result of "possibly unused" means exactly that: this granted action was not matched by anything in the used-actions list you typed in, nothing more and nothing less. If your used-actions list is incomplete, this tool will over-report — treat every result as a starting point for investigation, not a final verdict.

The comparison is wildcard-aware in one direction: a broad granted permission such as s3:Get* is correctly recognized as "used" if a literal action from your list, like s3:GetObject, matches it. A literal granted action such as s3:DeleteObject, on the other hand, is only cleared by an identical or wildcard-covering entry in your used-actions list — so if your list also uses wildcards (e.g. s3:*), that clears any granted s3: action it covers too.

• Two-list comparison: policy JSON vs. a used-actions list you supply.
• Wildcard-aware matching in both directions of the comparison.
• Newline- or comma-separated input accepted for the used-actions box.
• Summary stat — count and percentage of granted actions not covered by your list.
• Sample policy + used-actions pair to see the tool in action immediately.
• 100% client-side — nothing is uploaded.

1. Paste the IAM policy whose grants you want to review.
2. Paste or type the actions you know are actually used — one per line or comma-separated — or click the sample to see a worked example.
3. Click Compare.
4. Review the summary stat and the list of granted actions not covered by your used-actions list.
5. Investigate each "possibly unused" action before removing it — this list is only as complete as the used-actions list you provided.

Example 1 — a genuinely narrow gap. Policy grants s3:GetObject and s3:DeleteObject; used-actions list has only s3:GetObject → s3:DeleteObject reported as possibly unused (1 of 2, 50%).

Example 2 — wildcard grant covered by a literal used action. Policy grants s3:Get*; used-actions list has s3:GetObject → not flagged, since the literal action matches the granted wildcard pattern.

Example 3 — comma-separated input. Typing s3:GetObject, s3:PutObject on one line in the used-actions box parses identically to listing them on separate lines.

• Surfaces least-privilege trimming candidates in seconds instead of manual cross-referencing.
• Flexible input — accepts however your used-actions list is already formatted.
• Honest framing — clearly a comparison of the two lists you provide, not a CloudTrail-backed usage audit.
• Private — nothing you paste leaves your browser.