The denial test that could have been a real command

The usual way to prove an IAM policy works is to try what it should forbid and watch it fail.

Aim that at a production box and the test only works when the policy is right. If the policy is wrong, it is not a test any more. It is the forbidden action, on production, run on purpose by the person checking it was impossible.

So should-be-denied tests run against a box created for the test and terminated after it. Never against anything real users hit.

A throwaway instance costs cents. The other option costs whatever the forbidden action costs.