Dana has AmazonS3FullAccess. The team wants every bucket in us-east-1. A guardrail is drafted in ~/home-region-only.json; read it, then embed it in dana's user as HomeRegionOnly:
sh
aws iam put-user-policy --user-name dana --policy-name HomeRegionOnly --policy-document file://home-region-only.json
aws s3 mb s3://away-1wa3win --region eu-west-1 --profile dana
aws s3 mb s3://home-1wa3win --region us-east-1 --profile danaThen ask the simulator what dana could do in eu-west-1 without trying:
sh
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/dana --action-names s3:CreateBucket --context-entries ContextKeyName=aws:RequestedRegion,ContextKeyValues=eu-west-1,ContextKeyType=string