1

I have our AWS Setup, everything is via SAML Federation (no IAM users). Users are added to groups in AD and granted roles, login via SSO.

My issue is how do I check a a specific users permissions/roles. Our AD granters say they have set it up, user complains it does not work.

Is there a way to actually test, can the AWS Simulator help?

2 Answers 2

1

You can use the AWS IAM Policy Simulator to find out if a principal is allowed to execute specific actions, and if the action is explicitly denied by a particular policy that is not directly attached to the principal, e.g. a permission boundary, a service control policy, a resource policy, etc.).

You can learn more here: Testing IAM policies with the IAM policy simulator

2
  • 1. Simulator - based on the Federation scenario - can I test it only for a self/logged in user or any user (we do not have IAM users). 2. Is there a CLI way to do this - understand Simulator/API also exists.
    – Sam-T
    Dec 24, 2020 at 15:22
  • You can check roles in the simulator, too.
    – Nexonus
    Aug 24, 2022 at 12:51
0

We're using a NodeJS script to quickly validate user permissions via IAM.SimulatePrincipalPolicy. You can validate permissions for yourself or another user to which you have access:

https://gist.github.com/AnthumChris/cbfeeeec231394b7b369ea94eabcb812

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.