IAM policy simulator from fixtures
Check AWS IAM policies against your own test cases before you deploy them. Each case shows whether it is allowed, explicitly denied or implicitly denied, and which statements matched.
Up to 1,000,000 characters of policies, 5,000 statements and 500 test cases. Everything runs on your device in a background worker and nothing is sent to AWS. Downloads: CSV of decisions and a JSON report with each matched statement. Paste a policy document or an object with identityPolicies, permissionsBoundary and serviceControlPolicies. Up to 1,000,000 characters. Review the settings before running.
Your result
How to use IAM policy simulator from fixtures
- Paste a policy document, a list of documents, or an object with identityPolicies, permissionsBoundary and serviceControlPolicies.
- Add test cases, one per line as action resource key=value expect=allow, or as a JSON array.
- Run the simulation and review each decision with the matched statements.
- Download the CSV of decisions or the JSON report with every trace.
Useful next steps
Evaluation order
Happytails.ai follows the order described in the AWS IAM User Guide page "Policy evaluation logic" (docs.aws.amazon.com, read on 16 October 2026): an explicit Deny in any policy wins; otherwise service control policies and the permissions boundary must each allow the request; then an identity policy must allow it. Anything else is an implicit deny.
Matching
Actions match case-insensitively with * and ? wildcards and NotAction; resources match ARNs case-sensitively with Resource and NotResource. Policy variables such as ${aws:username} come from the case context. Conditions support the String, Numeric, Date, Bool, Binary, IpAddress, Arn and Null operators, IfExists, ForAllValues and ForAnyValue, with multiple keys combined with AND and multiple values with OR. Dates are ISO 8601 or epoch seconds, and a time without an offset is read as UTC. A request value that is not a plain number or a valid date never matches a numeric or date condition, and ${*}, ${?} and ${$} stand for the literal characters *, ? and $.
Not the AWS simulator
This is a model of the documented rules for the policies you paste. It does not call AWS and does not claim the same results as the IAM policy simulator: resource-based policies, session policies, resource control policies, service-specific behaviour and request context that AWS adds itself are not modelled. Use it to test intent, then confirm in AWS.