AWS tools
Policies and buckets: who can actually reach what.
AWS IAM Policy Validator & Analyzer
Valid JSON? And what does it grant?
Validate an AWS IAM policy and see what it actually grants: wildcards, escalation paths, and the exact line and column of any JSON error.
AWS IAM Policy Evaluator
Is this actually allowed?
Paste your IAM policies, name an action, resource and principal, and get a straight allowed or denied with the exact statement that decided it.
AWS S3 Bucket Policy Analyzer
Is this bucket actually public?
Paste an S3 bucket policy and get a straight answer on whether anyone on the internet can read, write or list it, plus the guardrails it is missing.
AWS S3 Bucket Policy Generator
Pick a pattern, get a safe policy
Generate an S3 bucket policy for private, CloudFront, cross-account or public-read access, with HTTPS-only, SSE-KMS, VPC endpoint and organization guardrails.
AWS ARN Decoder
Split it up, and check it is right
Break an AWS ARN into its fields and catch what makes one silently match nothing: wrong partition, missing region, or bucket versus object.
AWS ECS Task Definition Analyzer
Two roles, and they are not the same
Check an AWS ECS task definition for the execution role, the legal Fargate CPU and memory pairings, secrets in the environment and blocking log writes.
AWS S3 Lifecycle Policy Analyzer
Minimum durations you still pay
Check an AWS S3 lifecycle configuration for minimum billable durations, abandoned multipart uploads and rules that expire nothing on a versioned bucket.
AWS S3 Presigned URL Decoder
It dies with the session
Decode an AWS S3 presigned URL: who signed it, when it expires, and why a temporary credential makes X-Amz-Expires a number that does not apply.
AWS Lambda Configuration Analyzer
Memory is the CPU dial
Check an AWS Lambda function's configuration for deprecated runtimes, a reserved concurrency of zero, secrets in environment variables and the VPC trap.
AWS SQS Visibility Timeout Calculator
Six times the function timeout
Work out an AWS SQS visibility timeout from the consumer's timeout, and see why a dead letter queue with the same retention catches nothing.
AWS EventBridge Pattern Tester
Every leaf value is an array
Test an AWS EventBridge event pattern against an event in your browser, with prefix, suffix, numeric, anything-but, exists, wildcard and $or all evaluated.
AWS DynamoDB Capacity Calculator
Every index costs a write
Work out AWS DynamoDB read and write capacity units from item size and rate, including the index multiplier and the per-partition ceiling.
AWS Resource Name Validator
A dot in a bucket breaks TLS
Check AWS resource names against the per-service rules for S3, Lambda, DynamoDB, IAM, ECR, SQS and CloudFormation before something rejects them.
AWS CLI Profile Analyzer
The prefix rule is opposite
Check an AWS CLI config or credentials file for the profile prefix rule, broken role chains, missing regions and permanent keys held on disk.
AWS IAM Trust Policy Analyzer
Account root means the whole account
Check an AWS IAM role's trust policy: who can actually assume the role, and whether the OIDC subject and confused deputy conditions are there.
AWS Access Key ID Identifier
AKIA never expires, ASIA does
Identify what an AWS access key ID actually is from its prefix: a permanent credential, a temporary session, or an id that is not a credential at all.
AWS STS Assume Role Command Builder
Chaining caps at one hour
Build an aws sts assume-role command or a config profile, with the session duration rules that are not documented where you look for them.
AWS KMS Key Policy Analyzer
The one AWS mistake with no undo
Check an AWS KMS key policy for the two mistakes that lock a key permanently: no IAM delegation, and no principal able to change the policy.
AWS Security Group Analyzer
They cannot deny anything
Check AWS security group rules for ports open to the internet, and see why a security group needs no return-traffic rule and cannot block anything.
AWS Network ACL Return Traffic Checker
Stateless, so replies need a rule
Check AWS network ACL rules for the missing ephemeral port range that drops return traffic while the security group looks perfectly correct.