IAM Policy Diff
Paste an old and a new version of an AWS IAM policy JSON document and see exactly what changed — statements added or removed, actions and resources added or removed per statement, condition changes, and any new wildcard actions or scope widening flagged. Built for reviewing an infra change before it merges, not for scoring a single policy's absolute risk. Runs entirely in your browser.
Why not just use AWS IAM Access Analyzer or a policy risk scorer?
Those tools (and most online IAM analyzers) score a single policy's absolute risk. They don't answer the specific question you have during a pull request review: what actually changed between the old version and the new one? Even AWS's own CDK tooling has an open, acknowledged gap here (aws-cdk issue #43, "Improve diff of IAM policies"). This tool is built specifically for that comparison.
How does it match statements between the two policies?
By Sid. If both policies use Sids on their
statements, matching statements are compared field-by-field
(Action, Resource, Condition, Effect) to show exactly what
changed. Statements without a Sid in either policy can't be
reliably paired, so they're reported as whole blocks added or
removed instead of guessed at — give your statements Sids for a
precise diff.
Does this tool send my policy anywhere?
No. Everything runs in your browser — account IDs, resource ARNs, and the rest of your policy JSON are never uploaded, logged, or sent to a server.
Need this in a script or CI check instead of a browser?
The same diff logic is also a small dependency-free CLI/library:
npx github:diwaspoudell/iam-policy-diff — see
github.com/diwaspoudell/iam-policy-diff.