How to list all actions IAM role can perform on S3 bucket

Question

Given an IAM role and an S3 bucket, how can I extract a list of all the actions that IAM role is allowed to perform on that S3 bucket? Preferably using boto3.

Between S3 bucket policies denying roles that don't look like a certain string, cross account restrictions, differing allowed actions in the IAM policy and the S3 bucket policy, differing resolution of those disparities depending on same account/cross account status, and checking if this resource with a wildcard asterisk matches the resource in question, writing a parser for these policies is becoming a daunting task. Is there a simpler way?

I have a very large list of IAM roles and S3 buckets, so any kind of manual comparison would be too time consuming. Boto3 preferred, but not required.

Answer 1

IAM policy simulator is a handy tool to test complex policies and permissions. You will find it useful.