IAM Actions:Simulate Principal Policy

Search (SHIFT+S)

Simulate Principal Policy

POST /iam?Action=SimulatePrincipalPolicy

Simulate a set of IAM policies attached to an IAM entity (user, group, role) with a list of API operations and resources to determine the policies' effective permissions. If you specify a user, then the simulation also includes all of the policies that are attached to groups that the user belongs to.

Query Parameters

CallerArn	The ARN of the IAM user that you want to specify as the simulated caller of the API operations.
ActionNames	A list of names of API operations to evaluate in the simulation.
PolicyInputList	An optional list of additional policy documents to include in the simulation.
ContextEntries	A list of context keys and corresponding values for the simulation to use.
PolicySourceArn	ARN of a user, group, or role whose policies you want to include in the simulation.
Marker	Marker is obtained from paginated response from the previous query. Use this only if the response indicates it is truncated.
MaxItems	Indicates the maximum number of elements to be returned in the response.
PermissionsBoundaryPolicyInputList	An optional list of additional PermissionBoundaryPolicy documents to include in the simulation. Only 1 is allowed.

Required Roles

This call has no restrictions.

Request Payload

No Request Payload

Response Body

No Response Body

Examples

Request

NOTE:  Policy must be encoded
https://192.168.0.0::4443/iam?Action=SimulatePrincipalPolicy
&ActionNames.member.1=s3:GetObject
&ResourceArns.member.1="arn:aws:s3:::bucket"
&PolicySourceArn=arn:ecs:iam::ns1:user/testuser
&PolicyInputList.member.1='{
  "Version":"2012-10-17",
  "Statement":{
    "Effect":"Allow",
    "Action":"s3:*",
    "Resource":"*"
  }
}'
Accept: appliction/json
X-SDS-AUTH-TOKEN: <AUTH_TOKEN>
x-emc-namespace: <namespace>

Response

HTTP/1.1 200 OK
Content-Type: application/json

<?xml version="1.0" encoding="UTF-8" standalSimulatePrincipalPolicyone="yes"?>
<SimulatePrincipalPolicyResponse>
    <SimulatePrincipalPolicyResult>
        <IsTruncated>false</IsTruncated>
        <EvaluationResults>
            <member>
                <MatchedStatements>
                    <member>
                        <SourcePolicyId>policy1</SourcePolicyId>
                    </member>
                </MatchedStatements>
                <MissingContextValues/>
                <EvalResourceName>*</EvalResourceName>
                <EvalDecision>allowed</EvalDecision>
                <EvalActionName>s3:GetObject</EvalActionName>
            </member>
        </EvaluationResults>
    </SimulatePrincipalPolicyResult>
    <ResponseMetadata>
        <RequestId>0af9f5b8:17178fe9282:1086d:0</RequestId>
    </ResponseMetadata>
</SimulatePrincipalPolicyResponse>

Request

NOTE:  Policy must be encoded
https://192.168.0.0::4443/iam?Action=SimulatePrincipalPolicy
&ActionNames.member.1=s3:GetObject
&ResourceArns.member.1="arn:aws:s3:::bucket"
&PolicySourceArn=arn:ecs:iam::ns1:user/testuser
&PolicyInputList.member.1='{
  "Version":"2012-10-17",
  "Statement":{
    "Effect":"Allow",
    "Action":"s3:*",
    "Resource":"*"
  }
}'
Accept: appliction/json
X-SDS-AUTH-TOKEN: <AUTH_TOKEN>
x-emc-namespace: <namespace>

Response

HTTP/1.1 200 OK
Content-Type: application/json

{
    "ResponseMetadata": {
        "RequestId": "0af9f5b8:171648dacb1:1a5e4:13d"
    },
    "SimulatePrincipalPolicyResult": {
        "Marker": null,
        "EvaluationResults": [{
                "MatchedStatements": [{
                        "SourcePolicyId": "p1"
                    }
                ],
                "MissingContextValues": [],
                "EvalResourceName": "*",
                "EvalDecision": "allowed",
                "EvalActionName": "s3:GetObject",
                "ResourceSpecificResults": null,
                "EvalDecisionDetails": null
            }
        ],
        "IsTruncated": false
    }
}

Request

curl -H $token -H "Content-Type: application/json" -H "x-emc-namespace: <namespace>" -X GET https://$nodeIp:4443/iam?Action=SimulatePrincipalPolicy&ActionNames.member.1=s3:GetObject&ResourceArns.member.1="arn:aws:s3:::bucket"&PolicySourceArn=arn:ecs:iam::ns1:user/testuser&PolicyInputList.member.1='{"Version":"2012-10-17","Statement":{"Effect":"Allow","Action":"s3:*","Resource":"*"}}'

Response

HTTP/1.1 200 OK
Content-Type: application/json

<?xml version="1.0" encoding="UTF-8" standalSimulatePrincipalPolicyone="yes"?>
<SimulatePrincipalPolicyResponse>
    <SimulatePrincipalPolicyResult>
        <IsTruncated>false</IsTruncated>
        <EvaluationResults>
            <member>
                <MatchedStatements>
                    <member>
                        <SourcePolicyId>policy1</SourcePolicyId>
                    </member>
                </MatchedStatements>
                <MissingContextValues/>
                <EvalResourceName>*</EvalResourceName>
                <EvalDecision>allowed</EvalDecision>
                <EvalActionName>s3:GetObject</EvalActionName>
            </member>
        </EvaluationResults>
    </SimulatePrincipalPolicyResult>
    <ResponseMetadata>
        <RequestId>0af9f5b8:17178fe9282:1086d:0</RequestId>
    </ResponseMetadata>
</SimulatePrincipalPolicyResponse>