• IAM Actions

Simulate Custom Policy

Simulate a set of policies with a list of API operations and resources to determine the policies' effective permissions. If you specify a user, then the simulation also includes all of the policies that are attached to groups that the user belongs to.

Query Parameters

Required Roles

This call has no restrictions.

Request Payload

No Request Payload

Response Body

No Response Body

Examples

NOTE:  Policy must be encoded
https://192.168.0.0::4443/iam?Action=SimulateCustomPolicy
&ActionNames.member.1=s3:ListBucket
&ResourceArns.member.1="arn:aws:s3:::teambucket"
&PolicyInputList.member.1='{
  "Version":"2012-10-17",
  "Statement":{
    "Effect":"Allow",
    "Action":"s3:*",
    "Resource":"*"
  }
}'
&CallerArn=urn:ecs:iam::s3:user/test
&ResourcePolicy='{
    "Version":"2012-10-17",
    "Statement":{
        "Principal":"*",
        "Effect":"Allow",
        "Action":"s3:ListBucket",
        "Resource":"arn:aws:s3:::teambucket"
    }
}
Accept: appliction/json
X-SDS-AUTH-TOKEN: <AUTH_TOKEN>
x-emc-namespace: <namespace>

HTTP/1.1 200 OK
Content-Type: application/json

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SimulateCustomPolicyResponse>
    <SimulateCustomPolicyResult>
        <IsTruncated>false</IsTruncated>
        <EvaluationResults>
            <member>
                <MatchedStatements>
                    <member>
                        <SourcePolicyId>p1</SourcePolicyId>
                    </member>
                    <member>
                        <SourcePolicyId>Resource Policy</SourcePolicyId>
                    </member>
                </MatchedStatements>
                <MissingContextValues/>
                <EvalResourceName>arn:aws:s3:::teambucket</EvalResourceName>
                <EvalDecision>allowed</EvalDecision>
                <EvalActionName>s3:ListBucket</EvalActionName>
                <ResourceSpecificResults>
                    <member>
                        <MatchedStatements>
                            <member>
                                <SourcePolicyId>p1</SourcePolicyId>
                            </member>
                            <member>
                                <SourcePolicyId>Resource Policy</SourcePolicyId>
                            </member>
                        </MatchedStatements>
                        <MissingContextValues/>
                        <EvalResourceName>arn:aws:s3:::teambucket</EvalResourceName>
                        <EvalResourceDecision>allowed</EvalResourceDecision>
                    </member>
                </ResourceSpecificResults>
            </member>
        </EvaluationResults>
    </SimulateCustomPolicyResult>
    <ResponseMetadata>
        <RequestId>0af9f5b8:17178fe9282:1086d:0</RequestId>
    </ResponseMetadata>
</SimulateCustomPolicyResponse>

NOTE:  Policy must be encoded
https://192.168.0.0::4443/iam?Action=SimulatePrincipalPolicy
&ActionNames.member.1=s3:GetObject
&ResourceArns.member.1="arn:aws:s3:::bucket"
&PolicySourceArn=arn:ecs:iam::ns1:user/testuser
&PolicyInputList.member.1='{
  "Version":"2012-10-17",
  "Statement":{
    "Effect":"Allow",
    "Action":"s3:*",
    "Resource":"*"
  }
}'
Accept: appliction/json
X-SDS-AUTH-TOKEN: <AUTH_TOKEN>
x-emc-namespace: <namespace>

HTTP/1.1 200 OK
Content-Type: application/json

{
    "ResponseMetadata": {
        "RequestId": "0af9f5b8:171648dacb1:1a5e4:13d"
    },
    "SimulateCustomerPolicyResult": {
        "Marker": null,
        "EvaluationResults": [{
            "MatchedStatements": [{
                    "SourcePolicyId": "p1"
                }, {
                    "SourcePolicyId": "Resource Policy"
                }
            ],
            "MissingContextValues": [],
            "EvalResourceName": "arn:aws:s3:::teambucket",
            "EvalDecision": "allowed",
            "EvalActionName": "s3:ListBucket",
            "ResourceSpecificResults": [{
                "MatchedStatements": [{
                        "SourcePolicyId": "p1"
                    }, {
                        "SourcePolicyId": "Resource Policy"
                    }
                ],
                "MissingContextValues": [],
                "EvalResourceName": "arn:aws:s3:::teambucket",
                "EvalResourceDecision": "allowed",
                "EvalDecisionDetails": null
            }
            ],
            "EvalDecisionDetails": null
        }
        ],
        "IsTruncated": false
    }
}

NOTE:  Policy must be encoded

curl -H $token -H "Content-Type: application/json" -H "x-emc-namespace: <namespace>" -X POST https://$nodeIp:4443/iam?Action=SimulateCustomPolicy&ActionNames.member.1=s3:ListBucket&ResourceArns.member.1="arn:aws:s3:::teambucket"&PolicyInputList.member.1='{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"s3:*","Resource":"*"}}'&CallerArn=urn:ecs:iam::s3:user/test&ResourcePolicy='{"Version":"2012-10-17","Statement":{"Principal":"*","Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::teambucket"}}

HTTP/1.1 200 OK
Content-Type: application/json

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<SimulateCustomPolicyResponse>
    <SimulateCustomPolicyResult>
        <IsTruncated>false</IsTruncated>
        <EvaluationResults>
            <member>
                <MatchedStatements>
                    <member>
                        <SourcePolicyId>p1</SourcePolicyId>
                    </member>
                    <member>
                        <SourcePolicyId>Resource Policy</SourcePolicyId>
                    </member>
                </MatchedStatements>
                <MissingContextValues/>
                <EvalResourceName>arn:aws:s3:::teambucket</EvalResourceName>
                <EvalDecision>allowed</EvalDecision>
                <EvalActionName>s3:ListBucket</EvalActionName>
                <ResourceSpecificResults>
                    <member>
                        <MatchedStatements>
                            <member>
                                <SourcePolicyId>p1</SourcePolicyId>
                            </member>
                            <member>
                                <SourcePolicyId>Resource Policy</SourcePolicyId>
                            </member>
                        </MatchedStatements>
                        <MissingContextValues/>
                        <EvalResourceName>arn:aws:s3:::teambucket</EvalResourceName>
                        <EvalResourceDecision>allowed</EvalResourceDecision>
                    </member>
                </ResourceSpecificResults>
            </member>
        </EvaluationResults>
    </SimulateCustomPolicyResult>
    <ResponseMetadata>
        <RequestId>0af9f5b8:17178fe9282:1086d:0</RequestId>
    </ResponseMetadata>
</SimulateCustomPolicyResponse>