IAM Policy Simulation and Safety

Uber has developed a Policy Simulator to enhance the safety and determinism of IAM policy changes. This system allows policy authors to preview the impact of proposed changes in real-time by replaying access logs against both current and proposed policy sets. This helps prevent accidental outages caused by misconfigurations, particularly with grant removals or unintended privilege escalations. The simulator fetches access logs from various Policy Enforcement Points (PEPs), optimizes their ingestion into Apache Pinot for low-latency access, and replays them on local authorization engines to compare outcomes. Optimizations include prioritizing key data (actor, action, resource), focusing on distinct occurrences, and excluding irrelevant data. For coarse-grained policies, M3 access logs are used, while fine-grained policies leverage logs from authfx via Hive and Pinot.