How to perform logical OR with condition for an action in a IAM policy

Question

So I can't seem to find this but what I want to do is create a condition on an action in a policy based on tags.

Either the tag `aws:RequestTag/owner` OR the tag `aws:ResourceTag/owner` MUST be present AND be equal to `"${aws:PrincipalTag/owner}"` :

```
{
    "Sid": "AllowUnlessOwnedBySomeoneElse",
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
    "Condition": {
        "StringEquals": {
            'aws:RequestTag/owner': "${aws:PrincipalTag/owner}",
            'aws:ResourceTag/owner': "${aws:PrincipalTag/owner}"
        }
    }
}
```

The problem is that as it is current written above, this says that both the `aws:RequestTag/owner` AND the tag `aws:ResourceTag/owner` tags would be present which cant be true.

I need is so that at least one of those two tags is present and that they be equal to `${aws:PrincipalTag/owner}` .

How do I accomplish this?

Dennis_A · Accepted Answer

One way to approach this problem could be as follows :

```
{
    "Version": "2012-10-17",
    "Statement": [
    {
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*",
    "Condition": { "StringEquals":  'aws:RequestTag/owner': "${aws:PrincipalTag/owner}" }
     },
     {
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*",
    "Condition": { "StringEquals":  'aws:ResourceTag/owner': "${aws:PrincipalTag/owner}" }
     }
     ]
}
```
You can have multiple "Allow" constructs in a single IAM statement. 
Either of these could allow the action.

Matt · Answer

Create two separate statements:

```
{
    "Sid": "AllowUnlessOwnedBySomeoneElse",
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
    "Condition": {
        "StringEquals": {
            "aws:RequestTag/owner": "${aws:PrincipalTag/owner}",
        }
    }
},
{
    "Sid": "AllowUnlessOwnedBySomeoneElse2",
    "Effect": "Allow",
    "Action": "*",
    "Resource": "*"
    "Condition": {
        "StringEquals": {
            "aws:ResourceTag/owner": "${aws:PrincipalTag/owner}"
        }
    }
}
```

Make sure you also have a look at [the page that details which services do and don't support ABAC](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html) as well.

How to perform logical OR with condition for an action in a IAM policy

Relevant content