aws_iam_simulate
Simulate IAM permissions to verify if a principal can perform specific actions on resources, preventing 403 errors by testing policies before execution.
Instructions
Simulate IAM permissions for a principal: can principal X do actions Y on resources Z? Wraps iam simulate-principal-policy. Returns one entry per (action, resource) pair with decision (allowed / explicitDeny / implicitDeny / unknown -- unknown is the malformed-response fallback when EvalDecision is missing or unrecognised), matchedStatementIds (which IAM statements decided), and missingContextValues (context keys the policy needed but you didn't provide -- common for tag-based policies). Use this BEFORE a risky operation to avoid a 403; pairs with the post-failure Suggestion you get from aws_call. Requires iam:SimulatePrincipalPolicy on the caller.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| principalArn | Yes | ARN of the principal whose policies you want to evaluate, e.g. 'arn:aws:iam::123456789012:user/jeff' or 'arn:aws:iam::123456789012:role/my-role'. | |
| actions | Yes | IAM action names to test, e.g. ['lambda:CreateFunction', 's3:GetObject']. 1-50 entries. Wildcards (e.g. 's3:*') are accepted. | |
| resources | No | Resource ARNs to test against, e.g. ['arn:aws:s3:::my-bucket/*']. When omitted, AWS applies its own default of ['*'] server-side (best-case 'is this action ever allowed?') -- this tool does not inject a ['*'] itself. | |
| contextEntries | No | Context keys for policies that depend on request context -- 'aws:RequestTag/Project' = 'foo', etc. Provide when the policy you're testing references condition keys; the response's `missingContextValues` will tell you which ones it wanted. | |
| profile | No | Override session profile for this call. | |
| region | No | Override session region for this call (IAM is global; affects API endpoint). | |
| timeoutMs | No | Timeout in milliseconds. Default 60000. |