New featureMedium

IAM Policy Simulator moves to the IAM console and adds additional capabilities

The IAM Policy Simulator is now integrated into the IAM console, adding support for testing SCPs, condition key effects, and policy exclusions

The IAM Policy Simulator has been integrated into the IAM console, replacing the standalone simulator site. This allows you to test policies in the same place where you manage your identities and policies. You can now include service control policies (SCPs) in your simulation to test how your organization's SCP hierarchy interacts with identity and resource policies. Through the API, you can test how condition keys such as region restrictions and tag requirements affect the outcome. New flexibility allows you to exclude specific policies to model "what if I remove this policy?" scenarios. Cross-account simulations now report per-policy decisions for identity and resource-based policies, with the matched statements returned for a denied request reflecting only the policies that drove the decision. These changes help teams automate policy unit testing, detect over-permissive access, and validate guardrails with greater confidence. These features are available in all AWS Regions where the IAM Policy Simulator is available. Access the IAM Policy Simulator in the IAM console by selecting Policy simulator in the navigation pane.

Read the original AWS announcement

Related articles and terms

AWS IAM Fine-Grained Access Control - How Policy-Based Design Achieves the Principle of Least PrivilegeExplore the design philosophy behind AWS IAM's policy-based access control and compare its granularity with Azure RBAC and GCP IAM in concrete terms.IAM Policy Evaluation Logic Explained - How Implicit Deny Loses to Explicit AllowA step-by-step explanation of how IAM evaluates requests to allow or deny them, covering the priority of implicit deny, explicit allow, and explicit deny, as well as intersection logic for SCPs, permission boundaries, and session policies.AWS IAMAn authentication and authorization service for securely controlling access to AWS resources, providing fine-grained access management through users, groups, roles, and policiesDesigning Identity and Access Management - Achieving Zero Trust Security with IAMLearn access management design techniques with AWS IAM, including the principle of least privilege, policy design, and achieving zero trust security through Cognito integration.Detecting Excessive Permissions with IAM Access Analyzer - External Access and Unused Permission AnalysisDetect unused permissions on IAM roles using CloudTrail-based analysis and auto-generate least-privilege policies. This guide covers external access detection and integrating custom policy checks into your CI/CD pipeline.