Tools for Cloud Architects

BY TOOLS.FUN  ·  MARCH 28, 2026  ·  5 min read

Cloud architects design, document, and validate infrastructure across multiple providers and abstraction layers. Between reviewing Terraform plans, validating IAM policies, decoding JWT tokens from identity providers, and scheduling maintenance windows, there's a continuous need for lightweight browser tools that handle the small tasks without opening a cloud console. Here are the Tools.Fun utilities that fit a cloud architect's workflow.

Part of the Tools for DevOps Engineers series. See the hub article for the complete guide.

JSON Formatter & Validator

Format and validate JSON IAM policies (AWS, GCP, Azure), CloudFormation resource definitions, API Gateway configurations, and Lambda event payloads. A malformed IAM policy silently denies access — validate the JSON structure before applying it.

AWS IAM tip: paste your IAM policy JSON here before uploading. Invalid JSON returns a cryptic API error, while a valid but incorrect policy silently fails permissions. Validate first.

JSON to YAML Converter

Convert JSON infrastructure configs to YAML for Terraform variable files, Kubernetes manifests, Helm chart values, GitHub Actions workflows, and Ansible inventory files. Most IaC toolchains prefer YAML — convert your JSON-first configs in one step.

Helm tip: convert your values.json overrides to values.yaml format here to use with helm install -f values.yaml without modifying your toolchain.

Crontab Calculator

Validate and visualise the cron expressions used in cloud schedulers: AWS EventBridge rules, GCP Cloud Scheduler jobs, Azure Logic Apps recurrence triggers, and Kubernetes CronJobs. See the next 10 execution times and get a plain-English schedule description before deploying.

AWS EventBridge note: EventBridge uses a 6-field cron format (with a year field) that differs from standard 5-field Unix cron. Test here before deploying to catch the difference.

IP Lookup

Identify the geolocation, ASN, and cloud provider behind IP addresses from VPC flow logs, WAF request logs, CDN access logs, and security group audit findings. Determine whether traffic originates from a known cloud provider range or an unexpected origin.

Architecture use: verifying that inter-service traffic stays within expected AWS/GCP/Azure IP ranges helps confirm that your private networking configuration is working as designed.

Base64 Encoder / Decoder

Decode cloud-issued tokens: Kubernetes service account tokens (JWTs), AWS Cognito tokens, GCP identity tokens, and Azure AD access tokens are all Base64url-encoded. Decode the payload section to inspect claims, expiry, audience, and issuer without a dedicated JWT library.

Diff Tool

Compare Terraform plan outputs, IAM policy versions, CloudFormation change sets, and Kubernetes manifest versions side by side. Validate infrastructure changes during code review before a terraform apply or kubectl apply.

Change management: paste the old and new Terraform resource config here during PR review to give reviewers a clean visual diff without needing Terraform installed locally.

RegExp Tester

Build and test the regex patterns used in IAM condition expressions, S3 bucket policy resource ARN patterns, CloudFront function rules, and WAF rule conditions. Validate that your patterns match the intended resource ARNs and paths before deploying.

MD5 / Hash Generator

Generate SHA-256 checksums for S3 object integrity verification, compute expected ETag values for multipart uploads, and verify artifact hashes in CI/CD supply chain security workflows.

Password Generator

Generate strong random secrets for cloud infrastructure: RDS master passwords, Redis auth tokens, API Gateway API keys, secret manager values, and encryption key material for non-KMS use cases.

URL Encoder / Decoder

Encode special characters in S3 object key URLs, API Gateway endpoint paths, and CloudFront signed URL parameters. Decode percent-encoded URLs from access logs and CDN request traces.

Timestamp Converter

Convert Unix timestamps from CloudWatch metrics, VPC flow log entries, CloudTrail events, and cloud billing records to human-readable UTC dates. Generate epoch values for time-range filters in cloud cost and usage queries.

AES Encryptor

Test AES-256 encryption for application-layer secrets management where cloud KMS isn't used. Verify that your client-side encryption and decryption produce consistent results before integrating with your key management workflow.

RSA Encryptor

Test RSA key operations for certificate-based authentication, signing workflows, and token verification in cloud identity scenarios. Validate key pair behaviour before implementing in infrastructure code.

JSON to XML Converter

Convert JSON payloads to XML for legacy enterprise integrations, SOAP-based cloud services, and AWS CloudFormation custom resource responses that require XML-format data exchange.

← Back