AWS IAM Policy Simulator

AWS evaluates IAM policies using a deny-overrides model: (1) Start with implicit DENY. (2) Evaluate all applicable policies. (3) If any policy has an explicit DENY matching the action+resource, access is denied regardless of any allows. (4) If any policy has an explicit ALLOW and no explicit deny exists, access is allowed. (5) Otherwise, implicit deny applies. This tool simulates steps 2-5 for a single policy document.

Implicit deny is the default — if no policy explicitly allows an action, it is denied. Explicit deny is a statement with Effect: Deny that overrides any allow statements, even from other policies or roles. Explicit denies are used in Service Control Policies (SCPs) and permission boundaries to enforce hard limits that cannot be overridden by identity-based policies.

IAM supports two wildcards: * (matches any combination of characters) and ? (matches any single character). For actions: s3:* matches all S3 actions, s3:Get* matches GetObject, GetBucketPolicy, etc. For resources: arn:aws:s3:::bucket/* matches all objects in a bucket. The wildcard * as the only resource matches everything.

ARNs uniquely identify AWS resources. Format: arn:partition:service:region:account-id:resource. Examples: arn:aws:s3:::my-bucket (S3 bucket, no region/account needed), arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0 (EC2 instance), arn:aws:iam::123456789012:user/alice (IAM user). Use * as resource in policies to match all resources of a service.

Identity-based policies attach to IAM users, groups, or roles and define what actions that identity can perform. Resource-based policies attach to AWS resources (S3 buckets, SQS queues, Lambda functions) and define who can access that resource. This simulator evaluates identity-based policies only. In real AWS, both types are evaluated together and access requires allows from both applicable policy types.