Securitain Docs
On this page

Policy Impact Preview

See the permission effect of a proposed policy change before applying it to AWS.

Making a permission change in AWS is easy. Understanding what that change will actually do — which actions it adds, which it removes, and whether it creates unintended access — requires careful analysis. Policy Impact Preview lets you evaluate a proposed policy change against the current assessed state and see the before/after permission difference, without writing anything to AWS.

The question it answers

If I apply this policy change to this identity, what would change about the effective permissions available to it?

Where to find Policy Impact Preview

IAM AnalyzerPoliciesAnalyzer

The capability is accessible through the policy analysis interface within the Policies area of IAM Analyzer. It is not a separate top-level navigation item — it appears in context when a policy is selected for analysis.

How a preview works

You supply a proposed policy change — for example, a revised policy document or an operation that describes what to add, remove or replace. Securitain evaluates the before state (current assessed permissions) against the after state (permissions resulting from the proposed change) and presents the diff.

Current policy state
  ↓
Apply proposed change (dry run)
  ↓
Preview: actions added | actions removed | actions unchanged
Preview computes the permission difference between current and proposed states — nothing is written to AWS during a preview.

No AWS resource is modified during a preview. The preview uses Securitain's internal assessment of the current permission state and applies the proposed change analytically.

Supported operations

Policy Impact Preview supports multiple operation types for describing a proposed change. Supported operations include adding a permission, removing a permission, replacing a policy statement, attaching an additional policy, detaching a policy, and restricting existing access with a condition or resource scope.

Note

The exact set of available operation types depends on your plan and environment.

Before and after comparison

The preview result shows:

  • Actions added — permissions that would become available after the change but are not currently in the assessed effective permission set.
  • Actions removed — permissions that would no longer be available if the change is applied.
  • Unchanged — permissions that remain the same regardless of the proposed change.
Added:     kms:Encrypt, kms:GenerateDataKey
Removed:   s3:DeleteObject
Unchanged: s3:GetObject, s3:PutObject, ec2:DescribeInstances

Preview is a dry run — it does not mean the change is safe to apply

Important

A preview result shows the computed permission effect based on the current assessed state. It does not validate business intent, confirm operational safety, or guarantee that applying the change will not break legitimate workloads. Always validate operational requirements with the identity owner before making production permission changes.

What Preview tells you

  • Which actions would be added
  • Which actions would be removed
  • The net permission effect of the proposed change

What Preview does not tell you

  • Whether removed actions are still operationally required
  • Whether the change is safe for production workloads
  • Whether runtime conditions change the behavior

When to use it

  • Before least-privilege changes — confirm that narrowing a policy does not remove actions the identity actively uses before applying the narrowed policy to AWS. See Least Privilege for usage-based evidence.
  • Before remediation — verify that a remediation recommendation will achieve the intended permission change.
  • When adding new permissions — check what existing capabilities a newly attached policy interacts with.
  • For policy review — compare two policy versions analytically without applying either to a live identity.

Evidence and limitations

Policy Impact Preview evaluates the proposed change against the permissions derived from the most recent assessed state. Limitations that apply to Effective Permissions also apply here:

  • runtime conditions in policy statements are not evaluated
  • session policies are not observed
  • SCP context is included where available; missing hierarchy data produces an Indeterminate result for those actions
  • resource policies are considered where collected for supported types

Limitation

The preview operates on Securitain's assessed state of the current permissions. If the live AWS environment has changed since the last scan, the preview reflects the state at last assessment — not the current live AWS state.
  1. 1

    Open the policy analysis interface

    Navigate to IAM Analyzer → Policies → Analyzer and select the identity or policy to review.

  2. 2

    Describe the proposed change

    Select the operation type and supply the proposed policy content or operation parameters.

  3. 3

    Review the before/after diff

    Inspect which actions would be added, which would be removed, and what remains unchanged.

  4. 4

    Validate with the identity owner

    Confirm that actions flagged as removed are not required by production workloads, edge-case operations or disaster recovery.

  5. 5

    Apply through your change process

    If the preview confirms the intended effect, apply the change through your customer-controlled IAM or IaC process.