AWS IAM Policy Visualizer & Graph Generator

What does the AWS IAM Policy Visualizer & Graph Generator do?

The AWS IAM Policy Visualizer & Graph Generator parses AWS Identity and Access Management (IAM) JSON policies and generates structured, interactive relationship diagrams (in Mermaid.js syntax or rendered interactive graphs). It maps permission connections sequentially from Policy Root → Access Decisions (Allow / Deny) → Action Codes → Target Resources → Conditions.

Core Concepts

Understanding IAM policy structures and graph visualization:

• Statement Decomposition: Analyzes each Statement block, distinguishing between Action/NotAction and Resource/NotResource declarations.
• Decision Branching: Categorizes permissions under explicit Allow (green) or Deny (red) decision nodes.
• Condition Tree Mapping: Resolves condition operators (StringEquals, ArnEquals, IpAddress, Bool) and attaches them to corresponding resource paths.
• Export & Fullscreen: Enables lossless 3x PNG clipboard copying and .mmd raw Mermaid diagram code exports.

How to use the tool?

1. Enter IAM Policy JSON: Paste your IAM policy document into the input editor or click Load Sample.
2. Generate Interactive Graph: Click Generate Interactive Graph to compile statement blocks into a visual flowchart.
3. Inspect & Export: Review permissions in the Interactive Diagram or Mermaid Markup tabs, and click Copy, Download, or Fullscreen.

Related Developer Utilities

If you work with AWS IAM policies, cloud security, and JSON schemas, explore these complementary tools:

• AWS IAM Policy Minifier: Compress IAM policies to resolve 6,144 character LimitExceeded errors.
• AWS IAM OIDC Thumbprint Calculator: Calculate 40-character SHA-1 CA thumbprints for GitHub Actions.
• cURL to AWS SigV4 Converter: Convert HTTP cURL calls into signed SigV4 headers.
• JSON Syntax Validator: Validate JSON policy documents and catch syntax errors.

REST API Integration

Blueutils provides a free REST API endpoint (POST https://blueutils.com/api/aws/aws-iam-policy-visualizer) to programmatically parse AWS IAM Policy JSON syntax and generate structured visual graphs in Mermaid.js syntax.

API Request Parameters

API Request Payload Examples

cURL

curl -X POST https://blueutils.com/api/aws/aws-iam-policy-visualizer \
  -H "Content-Type: application/json" \
  -d '{
    "rawText": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"AllowS3\", \"Effect\": \"Allow\", \"Action\": \"s3:*\", \"Resource\": \"*\"}]}"
  }'

Python

import requests

url = "https://blueutils.com/api/aws/aws-iam-policy-visualizer"
payload = {
    "rawText": '{"Version": "2012-10-17", "Statement": [{"Sid": "AllowS3", "Effect": "Allow", "Action": "s3:*", "Resource": "*"}]}'
}
headers = {"Content-Type": "application/json"}
response = requests.post(url, json=payload, headers=headers)
print(response.json())

Java

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        String jsonPayload = """
            {
                "rawText": "{\\"Version\\": \\"2012-10-17\\", \\"Statement\\": [{\\"Sid\\": \\"AllowS3\\", \\"Effect\\": \\"Allow\\", \\"Action\\": \\"s3:*\\", \\"Resource\\": \\"*\\"}]}"
            }
            """;

        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://blueutils.com/api/aws/aws-iam-policy-visualizer"))
            .header("Content-Type", "application/json")
            .POST(HttpRequest.BodyPublishers.ofString(jsonPayload))
            .build();

        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.body());
    }
}

API Response Parameters

API Response Payload Examples

Success Response (HTTP 200 OK)

{
  "isValid": true,
  "statements": [
    {
      "sid": "AllowS3",
      "effect": "Allow",
      "isNotAction": false,
      "isNotResource": false,
      "actions": ["s3:*"],
      "resources": ["*"],
      "conditions": []
    }
  ],
  "mermaid": "graph LR\n  classDef allow fill:#10B981,stroke:#047857,color:#FFF;\n  PolicyRoot[\"AWS IAM Policy\"] --> sid_0[\"AllowS3\"]\n..."
}

Validation Failure Response (HTTP 400 Bad Request)

{
  "isValid": false,
  "error": "Invalid IAM Policy: Missing \"Statement\" element."
}

Rate Limit Exceeded Response (HTTP 429 Too Many Requests)

{
  "error": "API rate limit exceeded. Please wait or contact support@blueutils.com."
}

Why use an API to visualize AWS IAM policies?

Integrating the AWS IAM Policy Visualizer API into security auditing pipelines, pull request reviewers, or AI agent tool calling provides key benefits:

• Rapid Script Validation: Converts raw JSON policies into structural node arrays to catch over-permissive wildcard assignments before Terraform deployments.
• Optimized Token Efficiency for AI Agents: LLMs frequently misinterpret nested condition blocks and NotAction bounds. Calling the API validates policy syntax deterministically without token consumption.
• Deterministic Accuracy Without Hallucinations: Ensures 100% accurate statement separation and clean Mermaid diagram generation.

Native Usage

How to audit and parse IAM policies locally in terminal environments or scripts:

Windows (CMD / PowerShell)

# Parse IAM statement effects in PowerShell
$policy = Get-Content -Path .\policy.json -Raw | ConvertFrom-Json
$policy.Statement | ForEach-Object { "$($_.Sid): $($_.Effect) -> $($_.Action)" }

Linux / Unix (Bash)

# Check IAM Statement elements using jq in Linux
cat policy.json | jq '.Statement[] | {Sid: .Sid, Effect: .Effect, Action: .Action}'

Python

Using Python:

import json

with open("policy.json") as f:
    policy = json.load(f)

statements = policy.get("Statement", [])
statements = statements if isinstance(statements, list) else [statements]
for stmt in statements:
    print(f"Statement: {stmt.get('Sid', 'N/A')} | Effect: {stmt.get('Effect')} | Actions: {stmt.get('Action')}")

Java

Using Java:

import java.nio.file.Files;
import java.nio.file.Paths;
import org.json.JSONObject;

public class IamPolicyAuditExample {
    public static void main(String[] args) throws Exception {
        String json = Files.readString(Paths.get("policy.json"));
        JSONObject policy = new JSONObject(json);
        System.out.println("Version: " + policy.optString("Version"));
    }
}