WhyAllowed Explains What an AWS Policy Actually Allows

Field notes

The interface separates identity-based policies, resource policies, SCPs, permissions boundaries, trust policies, KMS keys, and CloudTrail input before combining their effects. It also accepts contextual account and principal details, plus S3 encryption-key information, rather than treating a policy document in isolation. Example buttons focus on recognizable failure modes such as public S3, GitHub OIDC escalation, SSE-KMS denial, and oversized CloudTrail roles. The page says analysis is performed locally and pasted material disappears when the tab closes.