class AwsIDBrokerAssumeRoleValidator {

    public boolean canAssumeRoles(AmazonIdentityManagement iam, InstanceProfile instanceProfile,
            Collection<Role> roles, ValidationResultBuilder resultBuilder) {
        Collection<String> roleArns = roles.stream().map(Role::getArn).collect(Collectors.toCollection(TreeSet::new));

        for (Role instanceProfileRole : instanceProfile.getRoles()) {
            try {
                List<EvaluationResult> evaluationResults = awsIamService.simulatePrincipalPolicy(iam,
                        instanceProfileRole.getArn(), ASSUME_ROLE_ACTION, roleArns);
                for (EvaluationResult evaluationResult : evaluationResults) {
                    if (PolicyEvaluationDecisionType.Allowed.toString().equals(evaluationResult.getEvalDecision())) {
                        roleArns.remove(evaluationResult.getEvalResourceName());
                    }
                }
            } catch (AmazonIdentityManagementException e) {
                // Log the error and return true. We don't want to block if there is an IAM failure.
                // This can happen due to throttling or other issues.
                LOGGER.error("Unable to check assume role from instance profile {} for roles {} due to {}",
                        instanceProfile.getArn(), roleArns, e.getMessage(), e);
                return true;
            }
            if (roleArns.isEmpty()) {
                return true;
            }
        }

        if (roleArns.isEmpty()) {
            return true;
        } else {
            resultBuilder.error(
                    String.format("IDBroker instance profile (%s) doesn't have permissions to assume " +
                            "the role(s): %s", instanceProfile.getArn(), roleArns));
            return false;
        }
    }

}