SimulatePrincipalPolicy

Source: src/AWS/IAM/SimulatePrincipalPolicy.ts

Runtime binding for iam:SimulatePrincipalPolicy — evaluate how the policies attached to an existing IAM user, group, or role decide a list of actions. The “can principal X do Y?” primitive behind access-review dashboards and pre-flight permission checks.

The principal (PolicySourceArn) is chosen per request — audit tooling typically iterates entities discovered at runtime — so the binding takes no arguments and grants iam:SimulatePrincipalPolicy on *. Provide the implementation with Effect.provide(AWS.IAM.SimulatePrincipalPolicyHttp).

Simulating Policies

// init
const simulatePrincipalPolicy = yield* IAM.SimulatePrincipalPolicy();

// runtime
const { EvaluationResults } = yield* simulatePrincipalPolicy({
  PolicySourceArn: roleArn,
  ActionNames: ["s3:GetObject", "iam:DeleteRole"],
});
const denied = EvaluationResults?.filter(
  (r) => r.EvalDecision !== "allowed",
);