Azure tools
What the role actually grants, and what the token actually opens.
Azure RBAC has one rule that is read backwards more often than any other: NotActions is a SUBTRACTION from a single role definition, not a deny. A custom role written to withhold an action withholds it only from that role, so a principal who also holds Contributor still has it, and the only real deny in Azure is a deny assignment, which RBAC cannot create. Storage SAS tokens have the matching property: once issued, an account or service SAS cannot be revoked without rotating the account key.
Free, with no sign-up. Every one runs entirely in your browser: nothing you paste is uploaded, and there is no server to send it to.
Azure Storage Account Security Analyzer
The key makes the rest advisory
Check an Azure storage account: shared key access, public blob access, the network default action of Allow, and the soft delete that does not cover overwrites.
Azure VM Size Decoder
No d means no temp disk
Read an Azure VM size name: family, vCPUs, and what each feature letter means, including the d that is a temporary disk and the s that is premium storage.
Azure Cosmos DB Throughput Calculator
Divided evenly, not by demand
Work out how many physical partitions a Cosmos container splits into, what one partition key can therefore use, and whether autoscale is cheaper at your utilisation.
Azure Resource Name Validator
One set of rules per provider
Check Azure resource names against their own provider's rules: length, character set, and which types are globally unique because they become DNS labels.
Azure Blob Lifecycle Policy Analyzer
The tier you leave early is billed anyway
Check an Azure blob lifecycle policy for early deletion penalties, rules that match nothing without access tracking, and deletes with no prefix filter.
Azure NSG Rule Analyzer
First match wins, lowest number first
Read an Azure NSG in evaluation order: which rule decides each port, which are never reached, and what the default rules at 65000 already allow.
Azure RBAC Role Definition Analyzer
NotActions denies nothing
Read an Azure custom role and see what it grants. NotActions subtracts from that role alone, so a role written to withhold an action usually withholds it from nobody.
Azure Resource ID Parser
Type and name pairs, not a path
Break an Azure resource ID into subscription, resource group, provider and the type and name pairs after it, keeping the parents of a nested resource.
Azure Storage SAS Token Decoder
It cannot be revoked
Decode an Azure Storage SAS token: what it grants, when it expires in UTC, and whether it can be revoked at all without rotating the account key.