AWS IAM Conditional Policy using StringLike does not work

Question

I am currently creating a policy such that a certain tag say "abc" has a string containing only digits between 0-9 and it is of length 9 only.

To this end, I added the following in the IAM policy JSON

{
            "Sid": "VisualEditor7",
            "Effect": "Deny",
            "Action": "ec2:StartInstances",
            "Resource": "arn:aws:ec2:*:*:instance/*",
            "Condition": {
                "StringLike": {
                    "ec2:ResourceTag/sso": "[0-9]{9}"
                }
            }
        },
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "ec2:StartInstances"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:instance/*"
            ]
        }

However, the policy is not working as expected. Is this because regex is not accepted as a value of ResourceTag? Or am I missing something here?

re:Post Agent · Accepted Answer

The issue you're experiencing is due to the StringLike condition operator in IAM policies not supporting regular expressions.

The StringLike operator only supports simple pattern matching with the `*` and `?` wildcards. It performs a case-insensitive match where * represents any number of characters (including zero) and ? represents exactly one character.

For your specific use case, where you want to match a string containing only digits between 0-9 and exactly 9 characters long, AWS IAM doesn't provide an appropriate operator. It doesn't support a syntax that would allow specifying ranges of characters (such as `[0-9]`) to match. The length condition alone could be enforced with the `?` wildcard, such that `"?????????"` would match exactly nine characters, but it would allow any characters, not just digits 0-9.

The principle is that IAM policies are designed for access control, not for complex data validation. For intricate tag format requirements, it's often better to enforce these rules at the point where tags are created or modified, rather than trying to do so through IAM policies.  
**Sources**  
[IAM JSON policy elements: Condition operators - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html)  
[IAM JSON policy elements: Condition - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html)

AWS IAM Conditional Policy using StringLike does not work

Add your answer

Relevant content