Policy simulator

Simulate policies before applying them in IAM → Identity → Policy Simulator.

The Policy Simulator lets you verify whether a specific user or role can access a particular resource before making changes.

Run a Simulation

1. Go to Identity → Policy Simulator.
2. In Principal, select the target user or role.
3. In Service, select the target service.
4. In Action, select the action to verify.
5. In Resource, specify the target resource.
6. Click Run Simulation.

Interpret Results

Result	Meaning
Allowed	The action is permitted
Denied	The action is explicitly denied
Implicit Deny	No explicit allow policy exists, so the action is denied

The simulation result includes a list of policies that contributed to the decision.

Use Cases

• Verify a new policy works as intended before creating it
• Diagnose why a user cannot access a specific resource
• Preview the impact of role changes on existing permissions

TIP

Always run Policy Simulator before policy changes to prevent unintended permission exposure or blocking.