authorize
Pre-flight authorization check for an AWS operation. Resolves the IAM actions the operation requires, then asks AWS's own policy simulator (SimulatePrincipalPolicy) whether the current role (or a given principal) allows them. Returns resolution (exact|partial|unresolved) and evaluation (allowed|denied|unknown) as separate fields. Requires AWS credentials; without them evaluation=unknown with the reason.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| workflow | No | A named workflow from list_workflows (e.g. 's3-multipart-kms') | |
| operations | No | IAM action strings or SDK symbols, comma-separated (e.g. 's3:PutObject' or 's3.PutObject') | |
| principal_arn | No | Optional. IAM role/user ARN to simulate against. Defaults to the current caller via sts:GetCallerIdentity. |