Access is the foundation of security in AWS. You can learn all the fundamentals in an hour, but it gets complicated fast and there are lots of corner cases to remember.

Speed for learning and development is largely driven by the speed of your feedback loop. Running locally lets you move faster than having to deploy a pipeline every change; running unit tests enable faster development than manual testing.

IAM Test evaluates your policies as you type them. If you get faster feedback you get the right policy faster; but most importantly you learn faster making you a better practitioner. Better IAM practitioners make us all safer.
‍

See what happens and why
‍

You can see the final answer, what statements caused that answer, and exactly why each statement did or didn’t apply.

EXPLAIN: noun. A text display of an IAM statement, annotated with how it was interpreted for a single request.

This EXPLAIN shows that the request for s3:GetObject didn’t match because there are no matching actions in the policy:
‍
‍

{
  // Statement Matches
  "Effect": "Allow",
  "Action": [
    // Match
    "s3:GetObject", // Match
    "s3:GetObj*" // Match
    // 23 hidden Non Matching actions, click to show
  ],
  "Resource": "*" // Match
}

And in an unmatched statement you can see exactly why it didn’t match:

‍

{ // Statement Does Not Match
  "Effect": "Allow",
  "Action": "s3:PutObjectTagging", // Match
  "Resource": "arn:aws:s3:::wrong-bucket/*", // No Match
  "Condition": { // Match
    "ForAllValues:StringEqualsExternal Link": {
      "s3:RequestObjectTagKeys": [ // Match
        // s3:RequestObjectTagKeys is missing in the request, this automatically matches ForAllValues
        "department",
        "class",
      ]
    }
  }

‍

"We do these things not because they are easy, but because we thought they were going to be easy".
- The programmers credo
‍

There are many corner cases displaying a useful EXPLAIN. In an Action statement you only need one value out of 100 to have a statement apply, in a NotAction you need just one statement out of 100 to have the statement not apply.

For a positive operator set operator like ForAnyValue:StringEquals we highlight which values match the values in the policy:

{ // Statement Matches
  "Effect": "Allow",
  "Action": "*", // Match
  "Resource": "*", // Match
  "Condition": { // Match
    "ForAnyValue:StringEqualsExternal Link": {
      "aws:TagKeys": [ // Match
        "department", // Matches: "department"
        "class",
        // Unmatched Values:
        "format"
        "retention"
      ]
    }
  }
}

For a negative one such as ForAnyValue:StringNotLike we are focused on the values that are not in our policy:
‍

{ // Statement Matches
  "Effect": "Allow",
  "Action": "*", // Match
  "Resource": "*", // Match
  "Condition": { // Match
    "ForAnyValue:StringNotLikeExternal Link": {
      "aws:TagKeys": [ // Match
        "de*", // Non Matches: "department", "design"
        "class", // Non Matches: "class"
        // Matching Values:
        "format"
        "retention"
      ]
    }
  }
}

We have over 70 tests of individual policy elements to ensure the display is correct in every possible form of positive and negative operators and condition keys.

How to use IAM Test

1. Edit one of the example policies or put in your own. The editor validates policy syntax and much of the policy content.
‍

2. Add as many test cases as you want, they are evaluated instantly:

• If the action is a wildcard only action, that will be put in for you, no need to remember.
• You can add any valid context keys that were found in the policy. The tool knows which keys are single values or lists and will adjust the UI appropriately.
  ‍

3. You can choose the expected outcome. If you do, the answer will be highlighted green if it matches or red if it doesn’t.
‍

4. Click the answer or the “Explain” link to see how any answer was determined. Deny/Allow statements that apply are automatically shown. Statements that did not apply can be shown.
‍

5. Save the policy and scenarios to a unique URL for sharing. Send it to the intern, Jacob, I think we can trust him to copy and paste.

‍