Trying a command is one way to test a permission. For actions you would rather not try, such as deleting a bucket, ask IAM what it would decide.
user/leewho
s3:ListBucketaction
reportsresource
IAM evaluates the policies
explicitDenynothing is touched
Asking
sh
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/lee --action-names s3:ListBucket --resource-arns arn:aws:s3:::reports--policy-source-arnis the identity, by ARN.--action-namesis one or more actions.--resource-arnsis one or more resources.
The answer
json
{
"EvaluationResults": [
{
"EvalActionName": "s3:ListBucket",
"EvalResourceName": "arn:aws:s3:::reports",
"EvalDecision": "explicitDeny"
}
]
}EvalDecision is one of three words, the same three rules as the last lesson:
| EvalDecision | Means |
|---|---|
allowed | an Allow matches and no Deny does |
implicitDeny | nothing matches |
explicitDeny | a Deny matches |
The simulator reads the identity's own policies and those of its groups. It makes no request: nothing is listed, created or deleted, and the identity never knows you asked.