A SaaS team wants to know whether an IAM user will be allowed to call ec2:RebootInstances after a policy edit, before anyone saves the policy or makes the call. Which tool gives that preview?
Select an answer to reveal the explanation.
Short Explanation
You want a dress rehearsal of the permission, not a traffic camera and not a vulnerability scan. The policy simulator answers whether this user, with these policies, may call this action. Flow logs can only tell you packets after something is already talking.
Full Explanation
The IAM policy simulator evaluates identity policies, resource policies, and related boundaries for an action you have not taken yet, which is the preview this team wants before they save. VPC Flow Logs show network accepts and rejects, not IAM's decision about ec2:RebootInstances. Inspector reports vulnerabilities and exposure findings; it does not trial an IAM action. Resolver query logs show DNS questions, which are unrelated to whether reboot is allowed. Caveat: the simulator result is only as complete as the policies you include, and an Organizations SCP deny still wins in the live account if you left it out of the test. Operational check: run the simulator as the user against ec2:RebootInstances on the instance ARN, then save the policy only if the decision is allowed.