IAM Policy Simulator Moves Into the IAM Console, and Now Tests SCPs Too!

Hey everyone, it's me! Today I found an update that makes testing IAM permissions a lot smoother, so let me tell you about it.

AWS What's New aws.amazon.com

What was announced?

According to AWS What's New, IAM Policy Simulator, the tool you use to check what your IAM policies actually grant before deploying them, just got a major update. There are three main changes.

• The standalone simulator site is gone. The tool is now built into the IAM console
• You can now include service control policies (SCPs) in your simulations
• The simulator gained more flexibility to model scenarios security and platform teams actually run in practice

The story so far

Until now, IAM Policy Simulator lived as a separate, standalone site, apart from the IAM console where you manage your identities and policies. That meant switching back and forth between two different tools just to test a policy you were editing.

On top of that, simulations mainly covered identity-based and resource-based policies. There was no way to see, right in the tool, how your organization's SCP hierarchy would affect the outcome. You basically had to reason it out in your head.

What changes

The most immediately useful change is that you can now test policies in the same place you manage them, right inside the IAM console, with no more tool-hopping.

Here's what's new under the hood.

• SCP-aware simulation: See how your organization's SCP hierarchy combines with identity and resource policies to produce the final effective permissions
• Policy exclusion: Exclude a specific policy to model "what if I remove this?" scenarios, useful for tracking down overly permissive policies
• Per-policy decisions for cross-account simulations: Cross-account simulations now report a decision for each identity-based and resource-based policy involved

The goal is to help security and platform teams do things they've wanted to do for a while: automate policy unit tests, detect over-permissive access, and validate that guardrails are actually working as intended, with more confidence.

Dive Deep

Through the API, you can go even deeper. The announcement notes that you can test how condition keys, such as Region restrictions and tag requirements, affect the simulation outcome. That means you're not limited to the console UI. You can wire this into automated tests using the SimulatePrincipalPolicy and SimulateCustomPolicy APIs.

One detail worth highlighting: when a cross-account simulation results in a Deny, the matched statements returned now reflect only the policies that actually drove that decision, instead of listing statements from unrelated policies. That should make it much easier to pin down exactly which policy caused a request to be denied.

This update is available in every AWS Region where IAM Policy Simulator is available. You can reach it from the IAM console by selecting "Policy simulator" in the navigation pane.

Wrap-up

• IAM Policy Simulator moved from a standalone site into the IAM console
• You can now include SCPs in simulations to check how your organization's guardrails interact with identity and resource policies
• You can exclude specific policies to model "what if I removed this" scenarios
• Cross-account simulations now report per-policy decisions, making it easier to identify what caused a denial
• Through the API, you can also test the effect of condition keys like Region restrictions and tag requirements

If your team manages multiple SCPs and identity policies across an organization, this update is especially worth checking out!