Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ User Guide/ Access Analyzer/ Validating Policies/ Validating a Custom Identity Policy
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Validating a Custom Identity Policy

IAM Access Analyzer performs syntax checks and validation on IAM custom identity policies, IAM trust policies, and Organizations service control policies (SCPs). It provides detailed diagnostic findings to help you configure secure, functional identity policies. Policy validation check findings include security warnings, errors, general warnings, and suggestions. You can use the findings to create policies that are functional and secure. You can create or edit policies using the JSON policy editors in the IAM and Organizations consoles, or via APIs. IAM Access Analyzer directly provides policy validation findings, helping you quickly identify and resolve potential security issues. The following example describes how to validate a custom identity policy with Access Analyzer on the IAM console.

Validating Identity Policies (IAM Console)

  1. Log in to the new IAM console.
  2. In the navigation pane, click Identity Policies. In the upper right corner, click Create Identity Policy.

    Figure 1 Creating an identity policy

  3. Select JSON for Policy View.
  4. (Optional) In the Policy Content area, click Select Existing Policy, select an existing policy (for example, EVSFullAccessPolicy), and click OK.

    You can select multiple policies of the same applicable scope (either Global services or Project-level services.) If you need permissions for both global and project-level services, create two policies for more refined access control.

  5. Modify policy statements.

    The Version value of a custom policy must be 5.0.

    • Effect: Set it to Allow or Deny.
    • Action: Enter the actions listed in the API actions table (see Figure 2) of each service.
      Figure 2 API actions

      For details about the actions supported by each service in the API reference, see Identity Policy-based Authorization.

  6. The access analyzer automatically checks the policy and displays the check findings in the lower part of the Policy Content. You can click a result category to view details.

    • Security: Indicates security risks, which may be caused by overly permissive access.
    • Errors: Indicate errors that prevent the policy from functioning, such as grammar errors or invalid parameters. If an error occurs, the policy cannot be created.
    • Warnings: Indicate errors that prevent the policy from functioning, such as a mismatch between a parameter type and a value. The policy can still be created even if there is a warning.
    • Suggestions: Indicate suggestions for the policy to achieve expected results. For example, suggestions are given when there are empty arrays or empty objects.

    You are advised to adjust the policy based on the suggestions. Access Analyzer Policy Check Reference provides the solutions.

    Figure 3 Viewing policy validation check findings

  7. (Optional) Enter a brief description for the identity policy.
  8. Click OK.
  9. Attach the identity policy to a user group. Users in the group then have the permissions defined in the policy.

Helpful Links

Parent topic: Validating Policies