The CLI IAM Policy Simulate options does not allow the user to uncheck SCP evaluations like the console

[galley234]

Is your feature request related to a problem? Please describe.
We have SCP policies that have conditionals which break the policy simulator today. For this reason we cannot use the policy simulator without the ability to unselect SCPs during the policy evaluation. The console allows this by passing simulateOrganizations: false

Describe the solution you'd like
I'd like the policy simulator apis to support simulateOrganizations true or false

Describe alternatives you've considered
I am unaware of any other options. I considered attempting to monkey patch cli to send the value over, but decided to request the feature.

Additional context
I was able to see the simulateOrganizations: false through chrome debugging. We use this functionality to evaluate total permissions.

[kdaily]

Hi @galley234, thanks for your feature request. I'm going to reach out to the IAM team to see about this.

[galley234]

Do you need more information??

[galley234]

I am curious about when this could be delivered. The functionality is basically broken unless the option is added. Any insight would be appreciated. Many Thanks! Gary

[kdaily]

@galley234, I've requested an update from the IAM team. I haven't heard anything back as of yet.

[kdaily]

Since this is related to the service and not the CLI, I'm going to transfer this issue. It will remain open for your tracking.

[kdaily]

P44247253

[missphyrgames]

I'd also like an update on this as I have come across the same issue as @galley234 and found that the Policy Simulator on the AWS website sends simulateOrganizations: false when the SCP box is unchecked. The policy simulator in the SDK and CLI therefore give different results to the website (with the results from the SDK and CLI being incorrect for me).

Also, what is P44247253 that you have posted above @kdaily?

[kdaily]

Hi @missphyrgames and @galley234, thanks for your patience. I'll check in again with the service team.

[wimvanleuven]

The extra parameter SimulateOrganizations: false is missing on the API as well as per the docs. Boto3 misses it too ...
So, there is no way to script or automate policy simulations in case you need to disable the SCPs.

What was the feedback from service and other teams?

[lerljaku]

@kdaily whats their response?

[tim-finnigan]

Checking in - a service team member mentioned on the corresponding ticket for this that policy simulator does not support SCP with condition key. This is the case for both the API and console. Below is the excerpt from the documentation:

You can't test AWS Organizations service control policies (SCPs) with global condition keys.

(https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_testing-policies.html)

Does that address the issue here? I don't have as much context on this but you could also try reaching out to AWS Support for more information.