AWS IAM Policy Simulation

IAM Policy Simulator evaluates requested actions against a principal's policies without making the API call itself. Use it as a preflight check for high-risk policy changes, then verify the same path in a non-production account.

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123456789012:role/workload \
  --action-names s3:GetObject