IAM policy simulator
A policy validation tool provided by AWS IAM that simulates and verifies whether IAM policies allow or deny specific actions without issuing real requests.
Timeline (last 90 days)
The IAM policy simulator evaluates a request but never sends it to any AWS service, returning only allowed or denied, and when the result is accompanied by a policy statement it indicates which statement caused it.
The IAM policy simulator has two modes: Principal mode tests policies already attached to a user, role or user group, while Custom mode tests a policy written or pasted on the spot and saves nothing to the account.
Checking a draft policy on the command line should use Custom mode, corresponding to aws iam simulate-custom-policy; to test a policy already attached to an identity, use simulate-principal-policy.
All Facts (3)
The IAM policy simulator evaluates a request but never sends it to any AWS service, returning only allowed or denied, and when the result is accompanied by a policy statement it indicates which statement caused it.
50%UnverifiedThe IAM policy simulator has two modes: Principal mode tests policies already attached to a user, role or user group, while Custom mode tests a policy written or pasted on the spot and saves nothing to the account.
50%UnverifiedChecking a draft policy on the command line should use Custom mode, corresponding to aws iam simulate-custom-policy; to test a policy already attached to an identity, use simulate-principal-policy.
50%