aws-sdk-iam 1.149.0 → 1.150.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a520fbaf96bb3a4978ec0bf8fec3dd7d9ff42007774a7c9ae7f58270373bd93
-  data.tar.gz: b868271dc629015349bb0c9fe30a93c750f01c88ada71d60faded060140841ae
+  metadata.gz: b66f32cad3969e6b6ba620324ef7e3c5d26dc909ea4c7ee6ed0e59604b95dd56
+  data.tar.gz: e3b1a4647fc68faad0fb67f7166279c5e0c41e5bbdefca3504825709484504ec
 SHA512:
-  metadata.gz: e602d9216bccbe618b06fa51988cfd544f29b356b2d6dd06768a688fe6fd09133527fc4e9582cf0014d6fad98f18acb5ccc1f4e172fd2294115f08bf7586729e
-  data.tar.gz: 48984875303adc64eeec81a1af47d7d9b72a8f30978e57d2529ba1e6d5f2bc07378638626e96cfcc3d52fa97f4685727f774fe89b792a543700727f41bf99d3d
+  metadata.gz: 03430a3d28a77cb277212bbf4fef96a2ccbfb891bb4ae167c67d9a77390ede99a99d916524b588559e346f6b755a7d8539c919becf0dbbc101a367882780cd5d
+  data.tar.gz: a35803d7a207a69b25b6355815c3deb1d330b603e178dfbd8ef3c4b34d583d0553b5872d1969811553fbd8272dd0fbc58fc1194a7b882e3344f9fdb91d63980d

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.150.0 (2026-07-30)
+------------------
+
+* Feature - Improved IAM Policy Simulator accuracy. Simulator now evaluates SCP conditions and resource scoping, returns explicitDeny for explicit SCP denials, and reports accurate cross-account decisions.
+
 1.149.0 (2026-07-09)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.149.0
+1.150.0

data/lib/aws-sdk-iam/client.rb

@@ -5318,7 +5318,10 @@ module Aws::IAM
     # request. Context keys can be evaluated by testing against a value in
     # an IAM policy. Use [GetContextKeysForPrincipalPolicy][2] to understand
     # what key names and values you must supply when you call
-    # [SimulatePrincipalPolicy][3].
+    # [SimulatePrincipalPolicy][3]. This operation doesn't return context
+    # keys referenced by service control policies (SCPs). Only context keys
+    # referenced by the identity-based policies attached to the specified
+    # entity, and any additional policies that you provide, are included.
     #
     #
     #
@@ -11466,14 +11469,16 @@ module Aws::IAM
     # If the output is long, you can use `MaxItems` and `Marker` parameters
     # to paginate the results.
     #
-    # <note markdown="1"> The IAM policy simulator evaluates statements in the identity-based
-    # policy and the inputs that you provide during simulation. The policy
-    # simulator results can differ from your live Amazon Web Services
-    # environment. We recommend that you check your policies against your
-    # live Amazon Web Services environment after testing using the policy
-    # simulator to confirm that you have the desired results. For more
-    # information about using the policy simulator, see [Testing IAM
-    # policies with the IAM policy simulator ][3]in the *IAM User Guide*.
+    # <note markdown="1"> The IAM policy simulator evaluates statements in identity-based
+    # policies, service control policies (SCPs) including their condition
+    # keys and resource scoping, and the inputs that you provide during
+    # simulation. The policy simulator results can differ from your live
+    # Amazon Web Services environment. We recommend that you check your
+    # policies against your live Amazon Web Services environment after
+    # testing using the policy simulator to confirm that you have the
+    # desired results. For more information about using the policy
+    # simulator, see [Testing IAM policies with the IAM policy simulator
+    # ][3]in the *IAM User Guide*.
     #
     #  </note>
     #
@@ -11550,6 +11555,24 @@ module Aws::IAM
     #   [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity-length
     #   [3]: http://wikipedia.org/wiki/regex
     #
+    # @option params [Array<Types::OrderedOrganizationPolicyType>] :ordered_organization_policy_input_list
+    #   An ordered list of service control policies (SCPs) to include in the
+    #   simulation. Each element represents one level of an Organizations
+    #   hierarchy, from the organization root to the account.
+    #
+    #   The simulator evaluates SCPs in the order that you provide, consistent
+    #   with how Organizations enforces SCPs. The first element must represent
+    #   the organization root, and the last element must represent the
+    #   account. Any elements between them represent organizational units
+    #   (OUs) in descending order.
+    #
+    #   Use this parameter to simulate the effect of an SCP hierarchy without
+    #   calling [SimulatePrincipalPolicy][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html
+    #
     # @option params [required, Array<String>] :action_names
     #   A list of names of API operations to evaluate in the simulation. Each
     #   operation is evaluated against each resource. Each operation must
@@ -11636,13 +11659,13 @@ module Aws::IAM
     #   `arn:aws:iam::112233445566-ID:root`.
     #
     # @option params [String] :caller_arn
-    #   The ARN of the IAM user that you want to use as the simulated caller
-    #   of the API operations. `CallerArn` is required if you include a
-    #   `ResourcePolicy` so that the policy's `Principal` element has a value
-    #   to use in evaluating the policy.
+    #   The ARN of the IAM user, group, or role that you want to use as the
+    #   simulated caller of the API operations. `CallerArn` is required if you
+    #   include a `ResourcePolicy` so that the policy's `Principal` element
+    #   has a value to use in evaluating the policy.
     #
-    #   You can specify only the ARN of an IAM user. You cannot specify the
-    #   ARN of an assumed role, federated user, or a service principal.
+    #   You cannot specify the ARN of an assumed role, federated user, or a
+    #   service principal.
     #
     # @option params [Array<Types::ContextEntry>] :context_entries
     #   A list of context keys and corresponding values for the simulation to
@@ -11717,6 +11740,11 @@ module Aws::IAM
     #   resp = client.simulate_custom_policy({
     #     policy_input_list: ["policyDocumentType"], # required
     #     permissions_boundary_policy_input_list: ["policyDocumentType"],
+    #     ordered_organization_policy_input_list: [
+    #       {
+    #         service_control_policy_input_list: ["policyDocumentType"],
+    #       },
+    #     ],
     #     action_names: ["ActionNameType"], # required
     #     resource_arns: ["ResourceNameType"],
     #     resource_policy: "policyDocumentType",
@@ -11801,6 +11829,12 @@ module Aws::IAM
     # authorization to determine if the simulated policies allow or deny the
     # operations.
     #
+    # For cross-account simulations, `EvalDecisionDetails` returns the
+    # decision for each policy type (identity-based policy, resource-based
+    # policy, and permissions boundary). This helps you identify which
+    # policy type is responsible for an allow or deny decision when policies
+    # span multiple accounts.
+    #
     # **Note:** This operation discloses information about the permissions
     # granted to other users. If you do not want users to see other user's
     # permissions, then consider allowing them to use
@@ -11816,14 +11850,16 @@ module Aws::IAM
     # If the output is long, you can use the `MaxItems` and `Marker`
     # parameters to paginate the results.
     #
-    # <note markdown="1"> The IAM policy simulator evaluates statements in the identity-based
-    # policy and the inputs that you provide during simulation. The policy
-    # simulator results can differ from your live Amazon Web Services
-    # environment. We recommend that you check your policies against your
-    # live Amazon Web Services environment after testing using the policy
-    # simulator to confirm that you have the desired results. For more
-    # information about using the policy simulator, see [Testing IAM
-    # policies with the IAM policy simulator ][3]in the *IAM User Guide*.
+    # <note markdown="1"> The IAM policy simulator evaluates statements in identity-based
+    # policies, service control policies (SCPs) including their condition
+    # keys and resource scoping, and the inputs that you provide during
+    # simulation. The policy simulator results can differ from your live
+    # Amazon Web Services environment. We recommend that you check your
+    # policies against your live Amazon Web Services environment after
+    # testing using the policy simulator to confirm that you have the
+    # desired results. For more information about using the policy
+    # simulator, see [Testing IAM policies with the IAM policy simulator
+    # ][3]in the *IAM User Guide*.
     #
     #  </note>
     #
@@ -11911,6 +11947,27 @@ module Aws::IAM
     #   [2]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-quotas-entity-length
     #   [3]: http://wikipedia.org/wiki/regex
     #
+    # @option params [Array<Types::PolicyIdentifier>] :policy_exclusion_list
+    #   A list of policies to exclude from the simulation. Use this parameter
+    #   to test what the simulation result would be if a policy were removed,
+    #   without changing which policies are actually attached to the principal
+    #   identified by `PolicySourceArn`.
+    #
+    #   Each entry is a [PolicyIdentifier][1] that identifies one or more
+    #   policies to exclude by policy type, by Amazon Resource Name (ARN), or
+    #   by the name of an inline policy and the entity it is attached to.
+    #
+    #   Syntactically invalid identifiers, such as malformed ARNs or wildcards
+    #   in disallowed positions, cause the request to fail with an
+    #   `InvalidInput` error. Syntactically valid identifiers that don't
+    #   match any attached policy are ignored. Resource control policies
+    #   (RCPs) are not supported in this release; identifiers that target RCPs
+    #   are also ignored.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/IAM/latest/APIReference/API_PolicyIdentifier.html
+    #
     # @option params [required, Array<String>] :action_names
     #   A list of names of API operations to evaluate in the simulation. Each
     #   operation is evaluated for each resource. Each operation must include
@@ -11987,22 +12044,24 @@ module Aws::IAM
     #   `CallerArn`.
     #
     # @option params [String] :caller_arn
-    #   The ARN of the IAM user that you want to specify as the simulated
-    #   caller of the API operations. If you do not specify a `CallerArn`, it
-    #   defaults to the ARN of the user that you specify in `PolicySourceArn`,
-    #   if you specified a user. If you include both a `PolicySourceArn` (for
-    #   example, `arn:aws:iam::123456789012:user/David`) and a `CallerArn`
-    #   (for example, `arn:aws:iam::123456789012:user/Bob`), the result is
-    #   that you simulate calling the API operations as Bob, as if Bob had
-    #   David's policies.
-    #
-    #   You can specify only the ARN of an IAM user. You cannot specify the
-    #   ARN of an assumed role, federated user, or a service principal.
+    #   The ARN of the IAM user, group, or role that you want to specify as
+    #   the simulated caller of the API operations. If you do not specify a
+    #   `CallerArn`, it defaults to the ARN of the user, group, or role that
+    #   you specify in `PolicySourceArn`. If you include both a
+    #   `PolicySourceArn` (for example,
+    #   `arn:aws:iam::123456789012:user/David`) and a `CallerArn` (for
+    #   example, `arn:aws:iam::123456789012:user/Bob`), the result is that you
+    #   simulate calling the API operations as Bob, as if Bob had David's
+    #   policies.
+    #
+    #   You can specify the ARN of an IAM user, group, or role. You cannot
+    #   specify the ARN of an assumed role, federated user, or a service
+    #   principal.
     #
     #   `CallerArn` is required if you include a `ResourcePolicy` and the
-    #   `PolicySourceArn` is not the ARN for an IAM user. This is required so
-    #   that the resource-based policy's `Principal` element has a value to
-    #   use in evaluating the policy.
+    #   `PolicySourceArn` is not the ARN for an IAM user, group, or role. This
+    #   is required so that the resource-based policy's `Principal` element
+    #   has a value to use in evaluating the policy.
     #
     #   For more information about ARNs, see [Amazon Resource Names (ARNs)][1]
     #   in the *Amazon Web Services General Reference*.
@@ -12085,6 +12144,17 @@ module Aws::IAM
     #     policy_source_arn: "arnType", # required
     #     policy_input_list: ["policyDocumentType"],
     #     permissions_boundary_policy_input_list: ["policyDocumentType"],
+    #     policy_exclusion_list: [
+    #       {
+    #         policy_type: "inline", # accepts inline, aws-managed, user-managed, permission-boundary, scp, rcp
+    #         policy_arn: "arnType",
+    #         inline_policy_identifier: {
+    #           policy_name: "policyNameType", # required
+    #           attachment_type: "user", # required, accepts user, group, role
+    #           attachment_name: "AttachmentName", # required
+    #         },
+    #       },
+    #     ],
     #     action_names: ["ActionNameType"], # required
     #     resource_arns: ["ResourceNameType"],
     #     resource_policy: "policyDocumentType",
@@ -14726,7 +14796,7 @@ module Aws::IAM
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-iam'
-      context[:gem_version] = '1.149.0'
+      context[:gem_version] = '1.150.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-iam/client_api.rb

@@ -34,6 +34,8 @@ module Aws::IAM
     AttachUserPolicyRequest = Shapes::StructureShape.new(name: 'AttachUserPolicyRequest')
     AttachedPermissionsBoundary = Shapes::StructureShape.new(name: 'AttachedPermissionsBoundary')
     AttachedPolicy = Shapes::StructureShape.new(name: 'AttachedPolicy')
+    AttachmentName = Shapes::StringShape.new(name: 'AttachmentName')
+    AttachmentType = Shapes::StringShape.new(name: 'AttachmentType')
     BootstrapDatum = Shapes::BlobShape.new(name: 'BootstrapDatum')
     CallerIsNotManagementAccountException = Shapes::StructureShape.new(name: 'CallerIsNotManagementAccountException')
     CertificationKeyType = Shapes::StringShape.new(name: 'CertificationKeyType')
@@ -203,6 +205,7 @@ module Aws::IAM
     GetUserResponse = Shapes::StructureShape.new(name: 'GetUserResponse')
     Group = Shapes::StructureShape.new(name: 'Group')
     GroupDetail = Shapes::StructureShape.new(name: 'GroupDetail')
+    InlinePolicyIdentifierType = Shapes::StructureShape.new(name: 'InlinePolicyIdentifierType')
     InstanceProfile = Shapes::StructureShape.new(name: 'InstanceProfile')
     InvalidAuthenticationCodeException = Shapes::StructureShape.new(name: 'InvalidAuthenticationCodeException', error: {"code" => "InvalidAuthenticationCode", "httpStatusCode" => 403, "senderFault" => true})
     InvalidCertificateException = Shapes::StructureShape.new(name: 'InvalidCertificateException', error: {"code" => "InvalidCertificate", "httpStatusCode" => 400, "senderFault" => true})
@@ -296,9 +299,11 @@ module Aws::IAM
     OpenIDConnectProviderListType = Shapes::ListShape.new(name: 'OpenIDConnectProviderListType')
     OpenIDConnectProviderUrlType = Shapes::StringShape.new(name: 'OpenIDConnectProviderUrlType')
     OpenIdIdpCommunicationErrorException = Shapes::StructureShape.new(name: 'OpenIdIdpCommunicationErrorException', error: {"code" => "OpenIdIdpCommunicationError", "httpStatusCode" => 400, "senderFault" => true})
+    OrderedOrganizationPolicyType = Shapes::StructureShape.new(name: 'OrderedOrganizationPolicyType')
     OrganizationIdType = Shapes::StringShape.new(name: 'OrganizationIdType')
     OrganizationNotFoundException = Shapes::StructureShape.new(name: 'OrganizationNotFoundException')
     OrganizationNotInAllFeaturesModeException = Shapes::StructureShape.new(name: 'OrganizationNotInAllFeaturesModeException')
+    OrganizationPolicyListType = Shapes::ListShape.new(name: 'OrganizationPolicyListType')
     OrganizationsDecisionDetail = Shapes::StructureShape.new(name: 'OrganizationsDecisionDetail')
     PasswordPolicy = Shapes::StructureShape.new(name: 'PasswordPolicy')
     PasswordPolicyViolationException = Shapes::StructureShape.new(name: 'PasswordPolicyViolationException', error: {"code" => "PasswordPolicyViolation", "httpStatusCode" => 400, "senderFault" => true})
@@ -308,9 +313,12 @@ module Aws::IAM
     PolicyDetail = Shapes::StructureShape.new(name: 'PolicyDetail')
     PolicyEvaluationDecisionType = Shapes::StringShape.new(name: 'PolicyEvaluationDecisionType')
     PolicyEvaluationException = Shapes::StructureShape.new(name: 'PolicyEvaluationException', error: {"code" => "PolicyEvaluation", "httpStatusCode" => 500})
+    PolicyExclusionsListType = Shapes::ListShape.new(name: 'PolicyExclusionsListType')
     PolicyGrantingServiceAccess = Shapes::StructureShape.new(name: 'PolicyGrantingServiceAccess')
     PolicyGroup = Shapes::StructureShape.new(name: 'PolicyGroup')
     PolicyGroupListType = Shapes::ListShape.new(name: 'PolicyGroupListType')
+    PolicyIdentifier = Shapes::UnionShape.new(name: 'PolicyIdentifier')
+    PolicyIdentifierPolicyType = Shapes::StringShape.new(name: 'PolicyIdentifierPolicyType')
     PolicyIdentifierType = Shapes::StringShape.new(name: 'PolicyIdentifierType')
     PolicyNotAttachableException = Shapes::StructureShape.new(name: 'PolicyNotAttachableException', error: {"code" => "PolicyNotAttachable", "httpStatusCode" => 400, "senderFault" => true})
     PolicyParameter = Shapes::StructureShape.new(name: 'PolicyParameter')
@@ -1303,6 +1311,11 @@ module Aws::IAM
     GroupDetail.add_member(:attached_managed_policies, Shapes::ShapeRef.new(shape: attachedPoliciesListType, location_name: "AttachedManagedPolicies"))
     GroupDetail.struct_class = Types::GroupDetail
 
+    InlinePolicyIdentifierType.add_member(:policy_name, Shapes::ShapeRef.new(shape: policyNameType, required: true, location_name: "PolicyName"))
+    InlinePolicyIdentifierType.add_member(:attachment_type, Shapes::ShapeRef.new(shape: AttachmentType, required: true, location_name: "AttachmentType"))
+    InlinePolicyIdentifierType.add_member(:attachment_name, Shapes::ShapeRef.new(shape: AttachmentName, required: true, location_name: "AttachmentName"))
+    InlinePolicyIdentifierType.struct_class = Types::InlinePolicyIdentifierType
+
     InstanceProfile.add_member(:path, Shapes::ShapeRef.new(shape: pathType, required: true, location_name: "Path"))
     InstanceProfile.add_member(:instance_profile_name, Shapes::ShapeRef.new(shape: instanceProfileNameType, required: true, location_name: "InstanceProfileName"))
     InstanceProfile.add_member(:instance_profile_id, Shapes::ShapeRef.new(shape: idType, required: true, location_name: "InstanceProfileId"))
@@ -1738,10 +1751,15 @@ module Aws::IAM
     OpenIdIdpCommunicationErrorException.add_member(:message, Shapes::ShapeRef.new(shape: openIdIdpCommunicationErrorExceptionMessage, location_name: "message"))
     OpenIdIdpCommunicationErrorException.struct_class = Types::OpenIdIdpCommunicationErrorException
 
+    OrderedOrganizationPolicyType.add_member(:service_control_policy_input_list, Shapes::ShapeRef.new(shape: SimulationPolicyListType, location_name: "ServiceControlPolicyInputList"))
+    OrderedOrganizationPolicyType.struct_class = Types::OrderedOrganizationPolicyType
+
     OrganizationNotFoundException.struct_class = Types::OrganizationNotFoundException
 
     OrganizationNotInAllFeaturesModeException.struct_class = Types::OrganizationNotInAllFeaturesModeException
 
+    OrganizationPolicyListType.member = Shapes::ShapeRef.new(shape: OrderedOrganizationPolicyType)
+
     OrganizationsDecisionDetail.add_member(:allowed_by_organizations, Shapes::ShapeRef.new(shape: booleanType, location_name: "AllowedByOrganizations"))
     OrganizationsDecisionDetail.struct_class = Types::OrganizationsDecisionDetail
 
@@ -1784,6 +1802,8 @@ module Aws::IAM
     PolicyEvaluationException.add_member(:message, Shapes::ShapeRef.new(shape: policyEvaluationErrorMessage, location_name: "message"))
     PolicyEvaluationException.struct_class = Types::PolicyEvaluationException
 
+    PolicyExclusionsListType.member = Shapes::ShapeRef.new(shape: PolicyIdentifier)
+
     PolicyGrantingServiceAccess.add_member(:policy_name, Shapes::ShapeRef.new(shape: policyNameType, required: true, location_name: "PolicyName"))
     PolicyGrantingServiceAccess.add_member(:policy_type, Shapes::ShapeRef.new(shape: policyType, required: true, location_name: "PolicyType"))
     PolicyGrantingServiceAccess.add_member(:policy_arn, Shapes::ShapeRef.new(shape: arnType, location_name: "PolicyArn"))
@@ -1797,6 +1817,16 @@ module Aws::IAM
 
     PolicyGroupListType.member = Shapes::ShapeRef.new(shape: PolicyGroup)
 
+    PolicyIdentifier.add_member(:policy_type, Shapes::ShapeRef.new(shape: PolicyIdentifierPolicyType, location_name: "PolicyType"))
+    PolicyIdentifier.add_member(:policy_arn, Shapes::ShapeRef.new(shape: arnType, location_name: "PolicyArn"))
+    PolicyIdentifier.add_member(:inline_policy_identifier, Shapes::ShapeRef.new(shape: InlinePolicyIdentifierType, location_name: "InlinePolicyIdentifier"))
+    PolicyIdentifier.add_member(:unknown, Shapes::ShapeRef.new(shape: nil, location_name: 'unknown'))
+    PolicyIdentifier.add_member_subclass(:policy_type, Types::PolicyIdentifier::PolicyType)
+    PolicyIdentifier.add_member_subclass(:policy_arn, Types::PolicyIdentifier::PolicyArn)
+    PolicyIdentifier.add_member_subclass(:inline_policy_identifier, Types::PolicyIdentifier::InlinePolicyIdentifier)
+    PolicyIdentifier.add_member_subclass(:unknown, Types::PolicyIdentifier::Unknown)
+    PolicyIdentifier.struct_class = Types::PolicyIdentifier
+
     PolicyNotAttachableException.add_member(:message, Shapes::ShapeRef.new(shape: policyNotAttachableMessage, location_name: "message"))
     PolicyNotAttachableException.struct_class = Types::PolicyNotAttachableException
 
@@ -2034,6 +2064,7 @@ module Aws::IAM
 
     SimulateCustomPolicyRequest.add_member(:policy_input_list, Shapes::ShapeRef.new(shape: SimulationPolicyListType, required: true, location_name: "PolicyInputList"))
     SimulateCustomPolicyRequest.add_member(:permissions_boundary_policy_input_list, Shapes::ShapeRef.new(shape: SimulationPolicyListType, location_name: "PermissionsBoundaryPolicyInputList"))
+    SimulateCustomPolicyRequest.add_member(:ordered_organization_policy_input_list, Shapes::ShapeRef.new(shape: OrganizationPolicyListType, location_name: "OrderedOrganizationPolicyInputList"))
     SimulateCustomPolicyRequest.add_member(:action_names, Shapes::ShapeRef.new(shape: ActionNameListType, required: true, location_name: "ActionNames"))
     SimulateCustomPolicyRequest.add_member(:resource_arns, Shapes::ShapeRef.new(shape: ResourceNameListType, location_name: "ResourceArns"))
     SimulateCustomPolicyRequest.add_member(:resource_policy, Shapes::ShapeRef.new(shape: policyDocumentType, location_name: "ResourcePolicy"))
@@ -2053,6 +2084,7 @@ module Aws::IAM
     SimulatePrincipalPolicyRequest.add_member(:policy_source_arn, Shapes::ShapeRef.new(shape: arnType, required: true, location_name: "PolicySourceArn"))
     SimulatePrincipalPolicyRequest.add_member(:policy_input_list, Shapes::ShapeRef.new(shape: SimulationPolicyListType, location_name: "PolicyInputList"))
     SimulatePrincipalPolicyRequest.add_member(:permissions_boundary_policy_input_list, Shapes::ShapeRef.new(shape: SimulationPolicyListType, location_name: "PermissionsBoundaryPolicyInputList"))
+    SimulatePrincipalPolicyRequest.add_member(:policy_exclusion_list, Shapes::ShapeRef.new(shape: PolicyExclusionsListType, location_name: "PolicyExclusionList"))
     SimulatePrincipalPolicyRequest.add_member(:action_names, Shapes::ShapeRef.new(shape: ActionNameListType, required: true, location_name: "ActionNames"))
     SimulatePrincipalPolicyRequest.add_member(:resource_arns, Shapes::ShapeRef.new(shape: ResourceNameListType, location_name: "ResourceArns"))
     SimulatePrincipalPolicyRequest.add_member(:resource_policy, Shapes::ShapeRef.new(shape: policyDocumentType, location_name: "ResourcePolicy"))

data/lib/aws-sdk-iam/types.rb

@@ -3350,13 +3350,40 @@ module Aws::IAM
     # This data type is used by the return parameter of `
     # SimulateCustomPolicy ` and ` SimulatePrincipalPolicy `.
     #
+    # The simulator now returns a single `EvaluationResult` per action,
+    # regardless of how many resource ARNs are provided. Previously,
+    # simulating one action against N resources returned N evaluation
+    # results, each containing the same aggregate decision. The top-level
+    # fields (`EvalDecision`, `MatchedStatements`, `MissingContextValues`,
+    # `EvalDecisionDetails`) now represent the *aggregate* decision across
+    # all requested resources. The top-level `EvalDecision` reflects the
+    # most restrictive decision across all resources (for example, if any
+    # resource produces `explicitDeny`, the top-level decision is
+    # `explicitDeny`).
+    #
+    #  To see the decision for each individual resource, use
+    # `ResourceSpecificResults`. If your application parses evaluation
+    # results per resource ARN, update your code to read per-resource
+    # decisions from `ResourceSpecificResults` rather than from the
+    # top-level result.
+    #
     # @!attribute [rw] eval_action_name
     #   The name of the API operation tested on the indicated resource.
     #   @return [String]
     #
     # @!attribute [rw] eval_resource_name
-    #   The ARN of the resource that the indicated API operation was tested
-    #   on.
+    #   The ARN template for the simulated resource type (for example,
+    #   `arn:${Partition}:s3:::${BucketName}/${KeyName}`), or `*` if no ARN
+    #   format is defined for the action. This is not a specific
+    #   customer-provided resource ARN. To find the decision for a specific
+    #   resource, use `ResourceSpecificResults`.
+    #
+    #   <note markdown="1"> If you previously relied on `EvalResourceName` to identify which
+    #   specific resource a result applies to, you must now use the
+    #   `EvalResourceName` field within individual entries in
+    #   `ResourceSpecificResults` instead.
+    #
+    #    </note>
     #   @return [String]
     #
     # @!attribute [rw] eval_decision
@@ -3370,6 +3397,14 @@ module Aws::IAM
     #   that operation, then the explicit deny overrides any allow. In
     #   addition, the deny statement is the only entry included in the
     #   result.
+    #
+    #   In the top-level result, this field contains the union of matched
+    #   statements across all requested resources. Only statements that
+    #   contributed to the reported decision are included. For per-resource
+    #   matched statements, see `ResourceSpecificResults`. This field
+    #   doesn't include statements from service control policies (SCPs).
+    #   Only statements from identity-based and resource-based policies
+    #   appear here.
     #   @return [Array<Types::Statement>]
     #
     # @!attribute [rw] missing_context_values
@@ -3383,6 +3418,12 @@ module Aws::IAM
     #   [GetContextKeysForCustomPolicy][1] or
     #   [GetContextKeysForPrincipalPolicy][2].
     #
+    #   In the top-level result, this field contains the deduplicated set of
+    #   missing context values across all requested resources. This field
+    #   doesn't include context keys referenced by service control policies
+    #   (SCPs). Only context keys referenced by identity-based and
+    #   resource-based policies appear here.
+    #
     #
     #
     #   [1]: https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetContextKeysForCustomPolicy.html
@@ -3393,6 +3434,10 @@ module Aws::IAM
     #   A structure that details how Organizations and its service control
     #   policies affect the results of the simulation. Only applies if the
     #   simulated user's account is part of an organization.
+    #
+    #   For resources that don't support organization-level evaluation,
+    #   this field is omitted from the top-level result. For per-resource
+    #   details, see `ResourceSpecificResults`.
     #   @return [Types::OrganizationsDecisionDetail]
     #
     # @!attribute [rw] permissions_boundary_decision_detail
@@ -3407,6 +3452,9 @@ module Aws::IAM
     #   simulations. It contains a brief summary of how each policy type
     #   contributes to the final evaluation decision.
     #
+    #   In the top-level result, this map reports the most restrictive
+    #   decision per policy type across all requested resources.
+    #
     #   If the simulation evaluates policies within the same account and
     #   includes a resource ARN, then the parameter is present but the
     #   response is empty. If the simulation evaluates policies within the
@@ -5494,6 +5542,38 @@ module Aws::IAM
       include Aws::Structure
     end
 
+    # Identifies one or more inline policies that are embedded in IAM users,
+    # groups, or roles, by the name of the policy together with the type and
+    # name of the entity that it is attached to. Wildcard characters in the
+    # entity name can match multiple entities, so a single identifier can
+    # select more than one attached inline policy.
+    #
+    # @!attribute [rw] policy_name
+    #   The name of the inline policy.
+    #   @return [String]
+    #
+    # @!attribute [rw] attachment_type
+    #   The type of IAM entity that the inline policy is attached to.
+    #   @return [String]
+    #
+    # @!attribute [rw] attachment_name
+    #   The name of the IAM user, group, or role that the inline policy is
+    #   attached to. Wildcard characters are supported to match multiple
+    #   entities: use at most one `*` (matches any sequence of characters,
+    #   including none), and any number of `?` (each matches exactly one
+    #   character).
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/iam-2010-05-08/InlinePolicyIdentifierType AWS API Documentation
+    #
+    class InlinePolicyIdentifierType < Struct.new(
+      :policy_name,
+      :attachment_type,
+      :attachment_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Contains information about an instance profile.
     #
     # This data type is used as a response element in the following
@@ -8821,6 +8901,33 @@ module Aws::IAM
       include Aws::Structure
     end
 
+    # Represents one level of an Organizations hierarchy—the organization
+    # root, an organizational unit (OU), or an account—together with the
+    # service control policies (SCPs) that apply at that level. Each element
+    # in the list represents one level of the hierarchy, ordered from the
+    # organization root down to the account.
+    #
+    # For more information about SCPs, see [Service control policies
+    # (SCPs)][1] in the *Organizations User Guide*.
+    #
+    #
+    #
+    # [1]: https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html
+    #
+    # @!attribute [rw] service_control_policy_input_list
+    #   A list of SCP documents that apply at this level of the
+    #   Organizations hierarchy. Each document is specified as a string
+    #   containing the complete, valid JSON text of an SCP.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/iam-2010-05-08/OrderedOrganizationPolicyType AWS API Documentation
+    #
+    class OrderedOrganizationPolicyType < Struct.new(
+      :service_control_policy_input_list)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The request was rejected because no organization is associated with
     # your account.
     #
@@ -9277,6 +9384,57 @@ module Aws::IAM
       include Aws::Structure
     end
 
+    # Identifies one or more policies as a union type. Specify exactly one
+    # of `PolicyType`, `PolicyArn`, or `InlinePolicyIdentifier` to identify
+    # policies by their type, by Amazon Resource Name (ARN), or by the name
+    # of an inline policy and the entity it is attached to.
+    #
+    # @note PolicyIdentifier is a union - when making an API calls you must set exactly one of the members.
+    #
+    # @!attribute [rw] policy_type
+    #   The policy type to identify. All policies of the specified type are
+    #   matched.
+    #   @return [String]
+    #
+    # @!attribute [rw] policy_arn
+    #   The Amazon Resource Name (ARN) of an Amazon Web Services managed
+    #   policy or a customer managed policy that is attached to an IAM user,
+    #   group, or role. Wildcard characters are supported in the resource
+    #   name portion of the ARN to match multiple managed policies: use at
+    #   most one `*` (matches any sequence of characters, including none),
+    #   and any number of `?` (each matches exactly one character).
+    #
+    #   For more information about ARNs, see [Amazon Resource Names
+    #   (ARNs)][1] in the *Amazon Web Services General Reference*.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html
+    #   @return [String]
+    #
+    # @!attribute [rw] inline_policy_identifier
+    #   An inline policy identifier consisting of a policy name and the
+    #   entity it is attached to. Wildcard characters (`*` and `?`) in the
+    #   entity name can match multiple entities.
+    #   @return [Types::InlinePolicyIdentifierType]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/iam-2010-05-08/PolicyIdentifier AWS API Documentation
+    #
+    class PolicyIdentifier < Struct.new(
+      :policy_type,
+      :policy_arn,
+      :inline_policy_identifier,
+      :unknown)
+      SENSITIVE = []
+      include Aws::Structure
+      include Aws::Structure::Union
+
+      class PolicyType < PolicyIdentifier; end
+      class PolicyArn < PolicyIdentifier; end
+      class InlinePolicyIdentifier < PolicyIdentifier; end
+      class Unknown < PolicyIdentifier; end
+    end
+
     # The request failed because Amazon Web Services service role policies
     # can only be attached to the service-linked role for that service.
     #
@@ -11092,6 +11250,25 @@ module Aws::IAM
     #   [3]: http://wikipedia.org/wiki/regex
     #   @return [Array<String>]
     #
+    # @!attribute [rw] ordered_organization_policy_input_list
+    #   An ordered list of service control policies (SCPs) to include in the
+    #   simulation. Each element represents one level of an Organizations
+    #   hierarchy, from the organization root to the account.
+    #
+    #   The simulator evaluates SCPs in the order that you provide,
+    #   consistent with how Organizations enforces SCPs. The first element
+    #   must represent the organization root, and the last element must
+    #   represent the account. Any elements between them represent
+    #   organizational units (OUs) in descending order.
+    #
+    #   Use this parameter to simulate the effect of an SCP hierarchy
+    #   without calling [SimulatePrincipalPolicy][1].
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/IAM/latest/APIReference/API_SimulatePrincipalPolicy.html
+    #   @return [Array<Types::OrderedOrganizationPolicyType>]
+    #
     # @!attribute [rw] action_names
     #   A list of names of API operations to evaluate in the simulation.
     #   Each operation is evaluated against each resource. Each operation
@@ -11184,13 +11361,13 @@ module Aws::IAM
     #   @return [String]
     #
     # @!attribute [rw] caller_arn
-    #   The ARN of the IAM user that you want to use as the simulated caller
-    #   of the API operations. `CallerArn` is required if you include a
-    #   `ResourcePolicy` so that the policy's `Principal` element has a
-    #   value to use in evaluating the policy.
+    #   The ARN of the IAM user, group, or role that you want to use as the
+    #   simulated caller of the API operations. `CallerArn` is required if
+    #   you include a `ResourcePolicy` so that the policy's `Principal`
+    #   element has a value to use in evaluating the policy.
     #
-    #   You can specify only the ARN of an IAM user. You cannot specify the
-    #   ARN of an assumed role, federated user, or a service principal.
+    #   You cannot specify the ARN of an assumed role, federated user, or a
+    #   service principal.
     #   @return [String]
     #
     # @!attribute [rw] context_entries
@@ -11265,6 +11442,7 @@ module Aws::IAM
     class SimulateCustomPolicyRequest < Struct.new(
       :policy_input_list,
       :permissions_boundary_policy_input_list,
+      :ordered_organization_policy_input_list,
       :action_names,
       :resource_arns,
       :resource_policy,
@@ -11398,6 +11576,28 @@ module Aws::IAM
     #   [3]: http://wikipedia.org/wiki/regex
     #   @return [Array<String>]
     #
+    # @!attribute [rw] policy_exclusion_list
+    #   A list of policies to exclude from the simulation. Use this
+    #   parameter to test what the simulation result would be if a policy
+    #   were removed, without changing which policies are actually attached
+    #   to the principal identified by `PolicySourceArn`.
+    #
+    #   Each entry is a [PolicyIdentifier][1] that identifies one or more
+    #   policies to exclude by policy type, by Amazon Resource Name (ARN),
+    #   or by the name of an inline policy and the entity it is attached to.
+    #
+    #   Syntactically invalid identifiers, such as malformed ARNs or
+    #   wildcards in disallowed positions, cause the request to fail with an
+    #   `InvalidInput` error. Syntactically valid identifiers that don't
+    #   match any attached policy are ignored. Resource control policies
+    #   (RCPs) are not supported in this release; identifiers that target
+    #   RCPs are also ignored.
+    #
+    #
+    #
+    #   [1]: https://docs.aws.amazon.com/IAM/latest/APIReference/API_PolicyIdentifier.html
+    #   @return [Array<Types::PolicyIdentifier>]
+    #
     # @!attribute [rw] action_names
     #   A list of names of API operations to evaluate in the simulation.
     #   Each operation is evaluated for each resource. Each operation must
@@ -11480,23 +11680,24 @@ module Aws::IAM
     #   @return [String]
     #
     # @!attribute [rw] caller_arn
-    #   The ARN of the IAM user that you want to specify as the simulated
-    #   caller of the API operations. If you do not specify a `CallerArn`,
-    #   it defaults to the ARN of the user that you specify in
-    #   `PolicySourceArn`, if you specified a user. If you include both a
+    #   The ARN of the IAM user, group, or role that you want to specify as
+    #   the simulated caller of the API operations. If you do not specify a
+    #   `CallerArn`, it defaults to the ARN of the user, group, or role that
+    #   you specify in `PolicySourceArn`. If you include both a
     #   `PolicySourceArn` (for example,
     #   `arn:aws:iam::123456789012:user/David`) and a `CallerArn` (for
     #   example, `arn:aws:iam::123456789012:user/Bob`), the result is that
     #   you simulate calling the API operations as Bob, as if Bob had
     #   David's policies.
     #
-    #   You can specify only the ARN of an IAM user. You cannot specify the
-    #   ARN of an assumed role, federated user, or a service principal.
+    #   You can specify the ARN of an IAM user, group, or role. You cannot
+    #   specify the ARN of an assumed role, federated user, or a service
+    #   principal.
     #
     #   `CallerArn` is required if you include a `ResourcePolicy` and the
-    #   `PolicySourceArn` is not the ARN for an IAM user. This is required
-    #   so that the resource-based policy's `Principal` element has a value
-    #   to use in evaluating the policy.
+    #   `PolicySourceArn` is not the ARN for an IAM user, group, or role.
+    #   This is required so that the resource-based policy's `Principal`
+    #   element has a value to use in evaluating the policy.
     #
     #   For more information about ARNs, see [Amazon Resource Names
     #   (ARNs)][1] in the *Amazon Web Services General Reference*.
@@ -11579,6 +11780,7 @@ module Aws::IAM
       :policy_source_arn,
       :policy_input_list,
       :permissions_boundary_policy_input_list,
+      :policy_exclusion_list,
       :action_names,
       :resource_arns,
       :resource_policy,

data/lib/aws-sdk-iam.rb

@@ -76,7 +76,7 @@ module Aws::IAM
   autoload :UserPolicy, 'aws-sdk-iam/user_policy'
   autoload :VirtualMfaDevice, 'aws-sdk-iam/virtual_mfa_device'
 
-  GEM_VERSION = '1.149.0'
+  GEM_VERSION = '1.150.0'
 
 end
 

data/sig/client.rbs

@@ -1617,6 +1617,11 @@ module Aws
       def simulate_custom_policy: (
                                     policy_input_list: Array[::String],
                                     ?permissions_boundary_policy_input_list: Array[::String],
+                                    ?ordered_organization_policy_input_list: Array[
+                                      {
+                                        service_control_policy_input_list: Array[::String]?
+                                      }
+                                    ],
                                     action_names: Array[::String],
                                     ?resource_arns: Array[::String],
                                     ?resource_policy: ::String,
@@ -1646,6 +1651,17 @@ module Aws
                                        policy_source_arn: ::String,
                                        ?policy_input_list: Array[::String],
                                        ?permissions_boundary_policy_input_list: Array[::String],
+                                       ?policy_exclusion_list: Array[
+                                         {
+                                           policy_type: ("inline" | "aws-managed" | "user-managed" | "permission-boundary" | "scp" | "rcp")?,
+                                           policy_arn: ::String?,
+                                           inline_policy_identifier: {
+                                             policy_name: ::String,
+                                             attachment_type: ("user" | "group" | "role"),
+                                             attachment_name: ::String
+                                           }?
+                                         }
+                                       ],
                                        action_names: Array[::String],
                                        ?resource_arns: Array[::String],
                                        ?resource_policy: ::String,

data/sig/types.rbs

@@ -1021,6 +1021,13 @@ module Aws::IAM
       SENSITIVE: []
     end
 
+    class InlinePolicyIdentifierType
+      attr_accessor policy_name: ::String
+      attr_accessor attachment_type: ("user" | "group" | "role")
+      attr_accessor attachment_name: ::String
+      SENSITIVE: []
+    end
+
     class InstanceProfile
       attr_accessor path: ::String
       attr_accessor instance_profile_name: ::String
@@ -1627,6 +1634,11 @@ module Aws::IAM
       SENSITIVE: []
     end
 
+    class OrderedOrganizationPolicyType
+      attr_accessor service_control_policy_input_list: ::Array[::String]
+      SENSITIVE: []
+    end
+
     class OrganizationNotFoundException < Aws::EmptyStructure
     end
 
@@ -1704,6 +1716,23 @@ module Aws::IAM
       SENSITIVE: []
     end
 
+    class PolicyIdentifier
+      attr_accessor policy_type: ("inline" | "aws-managed" | "user-managed" | "permission-boundary" | "scp" | "rcp")
+      attr_accessor policy_arn: ::String
+      attr_accessor inline_policy_identifier: Types::InlinePolicyIdentifierType
+      attr_accessor unknown: untyped
+      SENSITIVE: []
+
+      class PolicyType < PolicyIdentifier
+      end
+      class PolicyArn < PolicyIdentifier
+      end
+      class InlinePolicyIdentifier < PolicyIdentifier
+      end
+      class Unknown < PolicyIdentifier
+      end
+    end
+
     class PolicyNotAttachableException
       attr_accessor message: ::String
       SENSITIVE: []
@@ -2003,6 +2032,7 @@ module Aws::IAM
     class SimulateCustomPolicyRequest
       attr_accessor policy_input_list: ::Array[::String]
       attr_accessor permissions_boundary_policy_input_list: ::Array[::String]
+      attr_accessor ordered_organization_policy_input_list: ::Array[Types::OrderedOrganizationPolicyType]
       attr_accessor action_names: ::Array[::String]
       attr_accessor resource_arns: ::Array[::String]
       attr_accessor resource_policy: ::String
@@ -2026,6 +2056,7 @@ module Aws::IAM
       attr_accessor policy_source_arn: ::String
       attr_accessor policy_input_list: ::Array[::String]
       attr_accessor permissions_boundary_policy_input_list: ::Array[::String]
+      attr_accessor policy_exclusion_list: ::Array[Types::PolicyIdentifier]
       attr_accessor action_names: ::Array[::String]
       attr_accessor resource_arns: ::Array[::String]
       attr_accessor resource_policy: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-iam
 version: !ruby/object:Gem::Version
-  version: 1.149.0
+  version: 1.150.0
 platform: ruby
 authors:
 - Amazon Web Services