[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-11。"],[],[],null,["# Test principal access boundary policy changes with Policy Simulator\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\n\u003cbr /\u003e\n\nThis page describes how to simulate a change to a [principal access boundary (PAB)\npolicy](/iam/docs/principal-access-boundary-policies) or [binding](/iam/docs/principal-access-boundary-policies#binding) using Policy Simulator. It\nalso explains how to interpret the results of the simulation, and how to apply\nthe simulated principal access boundary policy or binding if you choose to.\n\nThis feature only evaluates access based on principal access boundary policies.\n\nTo learn how to simulate changes to other policy types, see the following:\n\n- [Test deny policy changes with Policy Simulator](/policy-intelligence/docs/simulate-deny-policies)\n- [Test organization policy changes with\n Policy Simulator](/policy-intelligence/docs/test-organization-policies)\n- [Test role changes with Policy Simulator](/policy-intelligence/docs/simulate-iam-policies)\n\nBefore you begin\n----------------\n\n-\n\n\n Enable the Cloud Asset Inventory, Identity and Access Management, Policy Analyzer, and Policy Simulator APIs.\n\n\n [Enable the APIs](https://console.cloud.google.com/flows/enableapi?apiid=assetinventory.googleapis.com,iam.googleapis.com,policyanalyzer.googleapis.com,policysimulator.googleapis.com)\n- Optional: Learn [how\n Policy Simulator for principal access boundary policies works](/policy-intelligence/docs/pab-simulator-overview).\n\n### Required roles\n\n\nTo get the permissions that\nyou need to test changes to principal access boundary policies and bindings,\n\nask your administrator to grant you the\nfollowing IAM roles on the organization:\n\n- [IAM Operation Viewer](/iam/docs/roles-permissions/iam#iam.operationViewer) (`roles/iam.operationViewer`)\n- [IAM Workforce Pool Admin](/iam/docs/roles-permissions/iam#iam.workforcePoolAdmin) (`roles/iam.workforcePoolAdmin`)\n- [IAM Workload Identity Pool Admin](/iam/docs/roles-permissions/iam#iam.workloadIdentityPoolAdmin) (`roles/iam.workloadIdentityPoolAdmin`)\n- [Organization Administrator](/iam/docs/roles-permissions/resourcemanager#resourcemanager.organizationAdmin) (`roles/resourcemanager.organizationAdmin`)\n- [Principal Access Boundary Policy Admin](/iam/docs/roles-permissions/iam#iam.principalAccessBoundaryAdmin) (`roles/iam.principalAccessBoundaryAdmin`)\n- [Workspace Pool IAM Admin](/iam/docs/roles-permissions/iam#iam.workspacePoolAdmin) (`roles/iam.workspacePoolAdmin`)\n\n\nFor more information about granting roles, see [Manage access to projects, folders, and organizations](/iam/docs/granting-changing-revoking-access).\n\n\nYou might also be able to get\nthe required permissions through [custom\nroles](/iam/docs/creating-custom-roles) or other [predefined\nroles](/iam/docs/roles-overview#predefined).\n\nStart a simulation\n------------------\n\nThe following sections describe the ways that you can start a simulation for a\nchange to a principal access boundary policy or binding.\n\n### Simulate a new binding for a principal access boundary policy\n\nFollow the steps to [create a policy binding](/iam/docs/principal-access-boundary-policies-create#create-binding), but don't\nclick **Add** after entering the binding details. Instead, click **Test\nchanges**.\n\n### Simulate an edit to an existing principal access boundary policy\n\nFollow the steps to [edit a principal access boundary policy](/iam/docs/principal-access-boundary-policies-edit#edit-policy), but\ndon't click **Save** after editing the policy. Instead, click **Test changes**.\n\n### Simulate an edit to an existing binding for a principal access boundary policy\n\nFollow the steps to [edit a policy binding](/iam/docs/principal-access-boundary-policies-edit#edit-binding), but don't\nclick **Save** after editing the binding. Instead, click **Test changes**.\n\n### Simulate deleting principal access boundary rules\n\n1. In the Google Cloud console, go to the **Principal Access Boundary\n policies** page.\n\n [Go to Principal Access Boundary\n policies](https://console.cloud.google.com/iam-admin/principal-access-boundary)\n2. Select the organization that owns the principal access boundary policy whose rules\n you want to delete.\n\n3. Click the policy ID of the principal access boundary policy whose rule you want to\n delete.\n\n4. In the **Boundary rules** table, select the rules that you want to\n delete, then click auto_delete **Test\n delete rules**.\n\n### Simulate deleting a principal access boundary policy\n\n1. In the Google Cloud console, go to the **Principal Access Boundary\n policies** page.\n\n [Go to Principal Access Boundary\n policies](https://console.cloud.google.com/iam-admin/principal-access-boundary)\n2. Select the organization that owns the principal access boundary policy whose binding\n you want to delete.\n\n3. Find the ID of the policy that you want to delete. In that policy's row,\n click more_vert **Actions** , then\n click **Test delete policy**.\n\n### Simulate deleting a binding for a principal access boundary policy\n\n1. In the Google Cloud console, go to the **Principal Access Boundary\n policies** page.\n\n [Go to Principal Access Boundary\n policies](https://console.cloud.google.com/iam-admin/principal-access-boundary)\n2. Select the organization that owns the principal access boundary policy whose binding\n you want to delete.\n\n3. Click the policy ID of the principal access boundary policy whose bindings you want\n to delete.\n\n4. Click the **Bindings** tab.\n\n5. Find the ID of the binding that you want to delete. In that binding's row,\n click more_vert **Actions** , then\n click **Test delete binding**.\n\nUnderstand simulation results\n-----------------------------\n\nThe results page for a principal access boundary policy or binding simulation contains\nthe following information:\n\n- An **Access revoked** section, which contains the following information:\n\n - The number of principals that would lose access if you applied the simulated principal access boundary policy or binding\n - The number of known resources that principals would lose access to if you applied the simulated principal access boundary policy or binding\n- An **Access gained** section, which contains the following information:\n\n - The number of principals that would gain access if you applied the simulated principal access boundary policy or binding\n - The number of known resources that principals would gain access to if you applied the simulated principal access boundary policy or binding\n- A table of the access changes, which shows the impact of the simulated policy\n or binding. To learn how to interpret these access changes, see\n [Policy Simulator results](/policy-intelligence/docs/pab-simulator-overview#review-results).\n\nTake action based on a simulation\n---------------------------------\n\nAfter reviewing a simulation report, you can take the following actions:\n\n- **Export the simulation results** : To export the results of a simulation as a\n CSV file, click **Export raw results**.\n\n When you click this button, a CSV file with the simulation reports is\n downloaded to your computer.\n- **Apply the simulated policy change**: The button that you click to apply\n a simulated policy change depends on the type of change you're simulating.\n\n - **Simulating an edited principal access boundary policy or rule, or a deleted\n rule** : click **Set policy**.\n - **Simulating a new or edited binding for a principal access boundary policy** : click **Set binding**.\n - **Simulating a deleted principal access boundary policy** : click **Delete\n policy**.\n - **Simulating a deleted binding for a principal access boundary policy** : click **delete binding**.\n\n When you click this button, the Google Cloud console sets the simulated\n policy or binding.\n- **Edit the simulated change to the policy or binding** : To make further\n changes to the simulated policy or policy binding, click **Back** or **Back to\n editing**.\n\n When you click this button, the Google Cloud console redirects you to the\n policy or policy binding editor.\n\nWhat's next\n-----------\n\n- [Test organization policy changes with\n Policy Simulator](/policy-intelligence/docs/test-organization-policies)\n- [Test role changes with Policy Simulator](/policy-intelligence/docs/simulate-iam-policies)"]]
