An S3 permission will be changed.
Check whether a particular user can call GetObject without testing in production.
Which tool is most appropriate?
Use the IAM policy simulator to evaluate the Allow or Deny result for the policy and request context.
Detailed explanation
CDN cache contents do not simulate an IAM authorization result.
CDN cache contents do not simulate an IAM authorization result.
S3 lifecycle management is not an IAM policy evaluation tool.
S3 lifecycle management is not an IAM policy evaluation tool.
DNS reachability checks do not simulate IAM authorization.
DNS reachability checks do not simulate IAM authorization.
The simulator evaluates policy statements and request context before the policy is used against production resources.
The simulator evaluates policy statements and request context before the policy is used against production resources.
Check official documentation
Compare the following points with the official documentation.
IAM policy simulatorの公式説明を確認する。
What to confirm
ポリシーシミュレーターと実際のCloudTrail監査を区別できる。
Key points
- IAM policy simulator
- Allow/Deny
- Resource
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Pre-change validation
Simulation exposes policy effects without requiring a production request.
Policy versus activity
The simulator evaluates permission; CloudTrail records activity after it happens.