# IAM policy simulator from fixtures

- Human page: https://happytails.ai/en/developer-tools/iam-policy-simulator-from-fixtures/
- Markdown: https://happytails.ai/en/developer-tools/iam-policy-simulator-from-fixtures.md
- Structured JSON: https://happytails.ai/agents/en/developer-tools/iam-policy-simulator-from-fixtures/index.json
- Visibility: public

## Tool capabilities

| Property | Value |
| --- | --- |
| Tool ID | `iam-policy-simulator-from-fixtures` |
| Category | developer-tools |
| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |
| Browser execution | Use the visible action or interactive controls. |
| Browser processing | Browser; see tool notes for network behavior. |
| HTTP API | Not callable through HTTP. |
| Browser-agent interface | run_current_tool |

### Implementation notes

Evaluates IAM policies against your test cases on your device using the documented AWS evaluation order. It is a model, not the AWS policy simulator. Up to 1,000,000 characters.

### Inputs and settings

Text input: IAM policies (JSON).

Example or placeholder shown in the interface (not a validated fixture):

```text
{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": "s3:GetObject", "Resource": "*"}]}
```

Paste a policy document or an object with identityPolicies, permissionsBoundary and serviceControlPolicies. Up to 1,000,000 characters. Review the settings before running.

| Setting | Meaning | Control type | Default | Constraints |
| --- | --- | --- | --- | --- |
| `cases` | Test cases | textarea | "" |  |

### Browser-agent workflow

1. Open the human page in a browser that supports WebMCP.
2. Discover the interface exposed by that page; use its actual schema.
3. Select files on the page first when the tool requires files.
4. Call `run_current_tool` with valid input and settings.
5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.

Calls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.

### Planning specification

Up to 1,000,000 characters of policies, 5,000 statements and 500 test cases. Everything runs on your device in a background worker and nothing is sent to AWS. Downloads: CSV of decisions and a JSON report with each matched statement.

This describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.

### Complete machine-readable capability record

```json
{
  "id": "iam-policy-simulator-from-fixtures",
  "category": "developer-tools",
  "built": true,
  "requirements": "Up to 1,000,000 characters of policies, 5,000 statements and 500 test cases. Everything runs on your device in a background worker and nothing is sent to AWS. Downloads: CSV of decisions and a JSON report with each matched statement.",
  "implementation": {
    "fields": [
      {
        "key": "cases",
        "label": "Test cases",
        "value": "",
        "type": "textarea",
        "help": "One per line: action resource key=value expect=allow, or a JSON array of objects with action, resource, context and expect. Up to 500 cases."
      }
    ],
    "registrationFamily": "config-infrastructure-json",
    "inputMaxLength": 1000000,
    "inputErrorCode": "CONFIG_INFRASTRUCTURE_JSON_TOO_LONG_IAM",
    "note": "Evaluates IAM policies against your test cases on your device using the documented AWS evaluation order. It is a model, not the AWS policy simulator. Up to 1,000,000 characters.",
    "experience": {
      "automatic": false,
      "single": false,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "IAM policies (JSON)",
      "placeholder": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Effect\": \"Allow\", \"Action\": \"s3:GetObject\", \"Resource\": \"*\"}]}",
      "help": "Paste a policy document or an object with identityPolicies, permissionsBoundary and serviceControlPolicies. Up to 1,000,000 characters. Review the settings before running.",
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}
```

## Page guide

Check AWS IAM policies against your own test cases before you deploy them. Each case shows whether it is allowed, explicitly denied or implicitly denied, and which statements matched.

How can we improve this tool?

Report a problem or share an idea.

Please leave out private information. Your message and the tool name go to our team via PostHog.

### How to use IAM policy simulator from fixtures

1. Paste a policy document, a list of documents, or an object with identityPolicies, permissionsBoundary and serviceControlPolicies.
2. Add test cases, one per line as action resource key=value expect=allow, or as a JSON array.
3. Run the simulation and review each decision with the matched statements.
4. Download the CSV of decisions or the JSON report with every trace.

## Useful next steps

- [JSON validator](https://happytails.ai/en/developer-tools/json-validator/) ([Markdown](https://happytails.ai/en/developer-tools/json-validator.md))

- [JSON formatter](https://happytails.ai/en/developer-tools/json-formatter/) ([Markdown](https://happytails.ai/en/developer-tools/json-formatter.md))

- [JSON diff](https://happytails.ai/en/developer-tools/json-diff/) ([Markdown](https://happytails.ai/en/developer-tools/json-diff.md))

## Evaluation order

Happytails.ai follows the order described in the AWS IAM User Guide page "Policy evaluation logic" (docs.aws.amazon.com, read on 16 October 2026): an explicit Deny in any policy wins; otherwise service control policies and the permissions boundary must each allow the request; then an identity policy must allow it. Anything else is an implicit deny.

### Matching

Actions match case-insensitively with \* and ? wildcards and NotAction; resources match ARNs case-sensitively with Resource and NotResource. Policy variables such as ${aws:username} come from the case context. Conditions support the String, Numeric, Date, Bool, Binary, IpAddress, Arn and Null operators, IfExists, ForAllValues and ForAnyValue, with multiple keys combined with AND and multiple values with OR. Dates are ISO 8601 or epoch seconds, and a time without an offset is read as UTC. A request value that is not a plain number or a valid date never matches a numeric or date condition, and ${\*}, ${?} and ${$} stand for the literal characters \*, ? and $.

### Not the AWS simulator

This is a model of the documented rules for the policies you paste. It does not call AWS and does not claim the same results as the IAM policy simulator: resource-based policies, session policies, resource control policies, service-specific behaviour and request context that AWS adds itself are not modelled. Use it to test intent, then confirm in AWS.