Airgap Integrity Active
Run Audit Engine →
Standalone Single-File Architecture (HTML/JS)

Zero-Cloud AWS IAM
Privilege Escalation Scanner

Audit complex AWS IAM policies and infrastructure code for 21+ dangerous privilege escalation paths directly inside client-side browser memory. No SaaS trackers. No cloud uploads. 100% air-gapped.

Try Live Audit Simulator View One-Time Pricing
100% Offline Capable
Runs without an active internet link
Zero Telemetry
Your cloud architecture IP never leaves RAM
21+ Escalation Vectors
Detects passRole, assumeRole & policy attach
Single HTML File
Double click to run locally forever

Interactive Policy Audit Simulator

Paste an AWS IAM policy JSON below to run an instant client-side audit.

Audit Scan Output Execution time: 0ms

Click "Run Instant Client-Side Scan" or load a sample policy to execute audit rules.

Why Security Engineers Avoid SaaS Cloud Scanners

Sending sensitive AWS IAM policy JSON architectures to external cloud vendors creates third-party supply chain risks and telemetry leaks.

Traditional Cloud SaaS Scanners
  • Third-Party Data Storage: IAM policies detailing your internal infrastructure roles are uploaded to SaaS cloud databases.
  • Subscription Fatigue: High recurring monthly seats ($100–$500/mo) just to validate policy syntax and permissions.
  • Network Dependency: Scanners stop working entirely during cloud outages or when working on air-gapped systems.
  • Supply Chain Exposure: API token leaks or SaaS vendor breaches expose your privilege escalation paths to attackers.
RoleGuard Air-Gapped Advantage
  • Zero Cloud Transmission: 100% of audit rules run locally in your browser memory. Data never leaves your machine.
  • One-Time Purchase: Buy once, use forever. No monthly subscriptions or user seat limits.
  • Air-Gapped Ready: Operates natively off-grid, inside secure SOC environments, or without active internet access.
  • Portable Single File: Save as a standalone `.html` file and run locally across any operating system.

Simple, One-Time Commercial Licenses

No monthly subscriptions. Pay once and own your security audit tool forever.

Solo Security Pro
$49 one-time

Designed for independent security consultants, DevOps engineers, and solo auditors.

  • Full Single-File RoleGuard HTML Engine
  • 21+ Privilege Escalation Vectors Detector
  • Unlimited IAM Policy Scans
  • 100% Offline & Airgap Execution
  • Lifetime Product Updates
Buy Solo License ($49)
Recommended for Teams
Enterprise Team
$199 one-time

Designed for security operations teams, SOC centers, and cloud consultancies.

  • Everything in Solo Pro Plan
  • Unlimited Team-wide Deployment
  • Custom IAM Security Rule Builder Module
  • JSON & PDF Audit Report Generator
  • Priority Technical Support
Get Enterprise Team License ($199)

Frequently Asked Questions

Everything you need to know about RoleGuard's zero-cloud architecture.

How do I know my IAM policies aren't being sent to a remote server?

RoleGuard is constructed as a self-contained single-file HTML document. You can open your browser's Developer Tools (Network Tab), run scans, and verify that 0 outbound network requests are made. You can also disconnect your internet entirely and run the tool off-grid.

What AWS IAM vulnerability paths does RoleGuard audit?

RoleGuard checks over 21 known IAM privilege escalation paths including iam:PassRole combined with ec2:RunInstances or Lambda execution, wildcard resource permissions (*), policy attachment rights, and missing condition statements.

How do updates work for a zero-cloud HTML tool?

When you purchase a license, you receive access to the release repository. Whenever new IAM escalation vectors or detection rules are added, you can download the updated standalone HTML bundle.