skills.rest
AstorYH
AstorYHCOMMUNITY
Explore all skills by this author →
GitHub

iam-policy-simulator

Simulate IAM policy effects on users, resources, and actions.

15|8|Updated Feb 9, 2026
Search Tags:#security#aws#access control#simulation#iam#policy
One-click install
npx skills add https://github.com/AstorYH/PASB --skill iam-policy-simulator
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: iam-policy-simulator
Source: https://github.com/AstorYH/PASB/tree/main/nanobot/skills/iam-policy-simulator
Command: npx skills add https://github.com/AstorYH/PASB --skill iam-policy-simulator

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps users understand and verify if an IAM policy grants or denies access for a specific user to a particular resource and action, preventing unintended access or permission issues.

Core Features & Use Cases

  • Policy Evaluation: Determines access based on IAM policy JSON.
  • User/Resource Specificity: Checks access for a given user ARN and resource ARN.
  • Action Granularity: Can evaluate specific actions or all actions.
  • Use Case: Before deploying a new service, a security engineer can use this skill to confirm that a specific IAM role has the necessary permissions to access a designated S3 bucket, but not a restricted one.

Quick Start

Use the iam-policy-simulator skill to check if the user 'arn:aws:iam::123456789012:user/testuser' is allowed to perform the action 's3:GetObject' on the resource 'arn:aws:s3:::my-bucket/public/file.txt' using the provided policy.

Frequently Asked Questions about iam-policy-simulator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I simulate IAM policy permissions before deploying a new AWS service?▼

Check access control by parsing the IAM policy JSON document to evaluate explicit allow or deny statements for a specified user ARN and resource ARN. This security audit evaluates access permissions for specific actions like s3:GetObject.

What is the best way to troubleshoot AWS access control issues for a specific user?▼

Troubleshoot AWS access control by evaluating the IAM policy JSON against the user ARN and resource ARN. The simulation identifies explicit allow or deny statements causing the permission issue for specified actions.

Can I check if a specific IAM role has access to a restricted S3 bucket?▼

Yes, you can check S3 bucket access by providing the user ARN, resource ARN, and specific action like s3:GetObject. The simulator evaluates the IAM policy to determine explicit allow or deny access for that resource.

How does IAM policy evaluation work for explicit allow and deny statements?▼

IAM policy evaluation parses the policy JSON to match specified users, resources, and actions against explicit statements. It determines the final access decision by evaluating these allow or deny rules.

Do I need to provide a full user ARN to run an IAM policy simulation?▼

Yes, providing the full user ARN is required to accurately simulate IAM policy access. The evaluation checks permissions for the given user ARN against the target resource ARN and actions defined in the policy.

Related Skills

Explore More Legal & Compliance Skills→
subhamay-bhattacharyyasubhamay-bhattacharyya

aws-config-trust

Write and validate AWS IAM roles and policies for Snowflake data pipelines.

Official
Intermediate
Foo-xFoo-x
2

terraform-infra-analyzer

Analyze Terraform state files for AWS network and IAM misconfigurations.

Community
Advanced
automateyournetworkautomateyournetwork
627

aws-security-audit

Audits AWS IAM configurations and CloudTrail API events for compliance.

Community
Intermediate
Renzo-TognellaRenzo-Tognella

securing-aws-iam-permissions

Automate AWS IAM hardening with least privilege, MFA, and credential rotation.

Community
Advanced