So far every statement applied whenever its action and resource matched. A Condition adds a third test: facts about the request itself.
The shape
{
"Effect": "Deny",
"Action": "s3:CreateBucket",
"Resource": "*",
"Condition": {
"StringNotEquals": { "aws:RequestedRegion": "us-east-1" }
}
}Condition maps an operator to a map of condition keys and values. This statement denies bucket creation anywhere except the home region. If the region is us-east-1 the condition fails, the statement does not apply, and nothing is denied by it.
Keys and operators
| Key | What it holds | Typical operator |
|---|---|---|
aws:RequestedRegion | the region the call targets | StringEquals, StringNotEquals |
aws:SourceIp | the caller's address | IpAddress, NotIpAddress |
aws:MultiFactorAuthPresent | true when the session used MFA | Bool, BoolIfExists |
aws:PrincipalArn | who is calling | ArnLike |
aws:username | the IAM user name | StringEquals, StringLike |
s3:prefix | the prefix of a list request | StringLike |
Operators are typed: strings, ARNs, booleans, numbers, dates, IP ranges. StringLike takes wildcards. IfExists on the end of an operator makes a missing key pass instead of fail, which matters for keys that are not present on every request.
Narrowing, never granting
A condition can only make a statement apply less often. An Allow with a condition grants in fewer cases; a Deny with a condition forbids in fewer cases. That is why guardrails are written as Deny unless:
{
"Effect": "Deny",
"Action": ["iam:*", "s3:DeleteBucket"],
"Resource": "*",
"Condition": { "BoolIfExists": { "aws:MultiFactorAuthPresent": "false" } }
}Any other Allow in the user's policies still stands, but this Deny wins over it whenever MFA is absent.
Testing conditions
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/dana \
--action-names s3:CreateBucket --context-entries ContextKeyName=aws:RequestedRegion,ContextKeyValues=eu-west-1,ContextKeyType=string--context-entries supplies the facts, so you can check what would happen from another region or another address without being there.