If you’ve ever worked with AWS IAM, you've probably felt this way.
You create a policy. Attach it to a user or role. And still get an "Access Denied" error.
That happened to me more than once.
While learning AWS, I even locked myself out of my account after giving the wrong permissions to a service. Not on purpose, I simply didn’t fully understand what the policy was actually allowing.
That’s when I realised guessing my way through IAM wasn’t helping.
While trying to make sense of it, I came across the IAM Policy Simulator, and it changed how I approach permissions.
What I like about the simulator is how simple the idea is.
It lets you test what a user or role can actually do before you change anything.
Instead of wondering, you can ask one clear question:
Can this user or role perform this action on this resource? (For example: Can this EC2 role read from this S3 bucket?)
The simulator checks all attached policies and shows you the final decision. Seeing it laid out like that helped me understand exactly where things were going wrong.
How I usually access it
When I need it, I:
Sign in to AWS.
Open the IAM service.
On the right-hand side, under Tools, click Policy Simulator.
It redirects to the Policy Simulator page.
Or open the IAM Policy Simulator directly here: IAM policy simulator
From there, I test the actions I’m unsure about and see what’s allowed or denied.
Why this matters (at least for me)
Most of the permission issues I’ve run into weren’t due to anything being missing.
They were small details:
A wrong resource ARN
A condition I didn’t think about
Or an explicit deny I forgot existed
The simulator doesn’t fix things for you or replace reading policies carefully, but it clearly shows which policies are affecting or attached to the user or role, and that makes IAM much less frustrating.
What I’m taking away from this
The IAM Policy Simulator has been a safer way for me to learn permissions. It lets me experiment, understand mistakes, and avoid granting extra permissions just to “make it work.”
I’m curious: When IAM permissions don’t work as expected, how do you usually debug them? Trial and error or stopping to inspect the policy closely?
If IAM or any AWS service has ever confused you, follow the
newsletter or the YouTube channel. I share what I learn as I continue making sense of AWS.
Stay updated with my projects by following me on Twitter, LinkedIn, and GitHub.
Thank you for reading!
Top comments (0)