Restricting when an IAM statement is allowed to apply — not just who or what, but during what window of time — is expressed through a global AWS condition key, aws:CurrentTime, compared against a fixed timestamp using the standard date operators DateGreaterThan and DateLessThan. Time-Based Access Policy Generator builds exactly this condition block from two ordinary datetime pickers, handling the ISO 8601 formatting AWS requires and the open-ended-window case that a hand-written condition often gets wrong.
You pick a start and an end using standard datetime-local inputs — the same native browser date/time picker used across countless forms — and the tool converts each one into the full ISO 8601 timestamp with a trailing Z that aws:CurrentTime expects, pairing the start with DateGreaterThan and the end with DateLessThan. Because either side of the window is frequently meant to be open-ended in practice — "access starts now, no fixed end" or "access must end by this date, no restriction on when it started" — leaving either the start or end field blank simply omits that half of the condition rather than forcing a placeholder timestamp into the JSON; only the entries that actually have a value are assembled into the final Condition block, and leaving both blank produces a statement with no time restriction at all.
One detail worth being explicit about, because it is a common source of confusion with this specific condition key: AWS evaluates aws:CurrentTime in UTC, and this tool's conversion takes the digits you select in the local datetime picker and appends Z to mark them as UTC directly — it does not read or apply your browser's local time zone offset. If you intend the window to line up with a specific wall-clock time in a non-UTC time zone, you need to do that offset conversion yourself before entering the values, the same care you would need with a hand-written aws:CurrentTime condition.
What this condition key genuinely cannot express, and what this tool does not attempt to fake, is a recurring schedule — "every weekday from 9 to 5," for instance. aws:CurrentTime compared with DateGreaterThan/DateLessThan only describes a single absolute start-and-end window; IAM has no native condition operator for day-of-week or time-of-day-only recurrence. A genuinely recurring access window requires an external mechanism outside a static policy document — something that periodically attaches, detaches, or updates the policy on a schedule — which is a different kind of system than a one-time JSON statement can express, and this tool is honest that it only builds the absolute-window form.
Beyond the time window itself, this is a standard statement builder: multi-line actions and resources, an optional Sid, and the same structural validator used across this tool category confirming the assembled document has a recognized Effect, Action, and Resource. The result is a ready-to-use time-scoped Allow statement — built and converted entirely in your browser, with nothing you enter sent anywhere.