IAM Policy Grammar - Clarification

0

Had a question around the policy grammar of IAM. In https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_grammar.html#policies-grammar-notes, towards the end of the grammar it says,

<condition_block> = "Condition" : { <condition_map> }
<condition_map> = { 
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  <condition_type_string> : { <condition_key_string> : <condition_value_list> }, ...
}  
<condition_value_list> = [<condition_value>, <condition_value>, ...]
<condition_value> = ("string" | "number" | "Boolean")

However, in this page https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html, I see the following example,

"Condition": {
  "StringEqualsIgnoreCase": {
    "aws:PrincipalTag/department": [ "finance", "hr", "legal" ],
    "aws:PrincipalTag/role": [ "audit", "security" ]
  },
  "StringEquals": {
    "aws:PrincipalAccount": "123456789012"
  }
}

So, shouldn't the grammar be the following?

<condition_block> = "Condition" : { <condition_map> }
<condition_map> = { 
  <condition_type_string> : { <condition_key_string> : <condition_value_list>, 
                              <condition_key_string> : <condition_value_list>,
                              ...
                             },
  <condition_type_string> : { <condition_key_string> : <condition_value_list>, 
                              <condition_key_string> : <condition_value_list>,
                              ...
                             },
  ...
}  
<condition_value_list> = [<condition_value>, <condition_value>, ...]

Did I not understand correctly? If I did, which one is correct, the example or the grammar?

1개 답변
0

Both of them are correct. As you can see below(I just enter the example condition into policy grammar), the example policy is following the policy grammar.

<condition_block> = "Condition" : { <condition_map> }
<condition_map> = { 
  <StringEqualsIgnoreCase> : { <aws:PrincipalTag/department> : <[ "finance", "hr", "legal" ]>, 
                               <aws:PrincipalTag/role> : <[ "audit", "security" ]>,
                              ...
                             },
  <StringEquals> : { <aws:PrincipalAccount> : < 123456789012 >
                              ...
                             },
  ...
profile pictureAWS
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠