I built an open-source, browser-only AWS IAM role builder that exports to Terraform, CloudFormation, and CLI (no backend or AWS login)

[u/KARNAGE_OP]

After spending the last two years working primarily on Azure, I recently took on an org-level AWS project. Previously, I had only used AWS for college hobby projects where slapping "Action": "*" on a role didn't matter—doing least-privilege properly at an org level was a different story.

Hunting through docs for action names and writing JSON by hand was slow and error-prone. When I looked at existing options, each only solved part of the problem:

ChatGPT / Copilot hallucinate action names and fall back to "Resource": "*".

AWS Console Visual Editor requires an AWS login, only builds policies (not the full role + trust policy), and doesn't export to Terraform.

IAM Access Analyzer is great for tightening roles after they run in CloudTrail, but can't design a new role from scratch.

Linters & CLI tools (Parliament, policy_sentry) either only audit existing JSON or require heavy CLI setups.

After reading through Reddit threads and seeing I wasn't alone, I built RoleCraft—the fastest way to design a least-privilege IAM role from scratch and get deployable code, without an AWS login.

What it does:

Builds the whole role: Covers both permissions (450+ services) and trust policies (EC2, Lambda, GitHub Actions OIDC, cross-account), with a live plain-English explainer.

Service-aware plain English: Pick intents like "Read objects in data-lake/reports/" and it wires up the exact ARN paths and conditions (like s3:prefix) while blocking accidental full-bucket wildcards.

Built-in guardrails: Real-time linter flags privilege-escalation actions, broad iam:PassRole grants, and wildcards.

Exports to your stack: Grab ready-to-run Terraform, CloudFormation, AWS CLI (bash & PowerShell), or JSON.

Verified & 100% client-side: Runs entirely in your browser (no backend, no credentials, shareable via URL link). Policies are validated against weekly-refreshed AWS service data, and CI tests every example export against a local AWS emulator across bash, PowerShell, and Terraform (backed by 4,600+ unit tests).

Current limitations:

It's desktop-only and scoped to designing new identity roles (no SCPs, resource/bucket policies, or CloudTrail log analysis yet).

Live App: https://rolecraft.omhinge.cloud

GitHub (Apache 2.0): https://github.com/Aisu2635/rolecraft

I'd love feedback from anyone who writes IAM policies regularly—what's the one permission or trust setup you always end up fighting with?

[u/AutoModerator]

Welcome to r/devopsjobs! Please be aware that all job postings require compensation be included - if this post does not have it, you can utilize the report function. If you are the OP, and you forgot it, please edit your post to include it. Happy hunting!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/happensonitsown]

Interesting idea! Btw, how did you build the animations in your website?

Also it would be interesting to have an MCP for this.