IAM Docs Feedback: Wrong condition operator modifier?

Question

I am trying to provide feedback on this [IAM docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) page.  When I click the feedback link, it takes me to [here](https://docs-feedback.aws.amazon.com/feedback.jsp?hidden_service_name=IAM&topic_url=https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html) which fails when I submit with this error:

```
HTTP Status 400 – Bad Request

Type Exception Report
Message Request header is too large
Description The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).
Exception
java.lang.IllegalArgumentException: Request header is too large
	org.apache.coyote.http11.Http11InputBuffer.parseHeaders(Http11InputBuffer.java:629)
	org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:535)
	org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
	org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:847)
	org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1680)
	org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
	org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
	org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
	org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
	java.lang.Thread.run(Thread.java:750)
Note The full stack trace of the root cause is available in the server logs.

Apache Tomcat/8.5.75
```

Consequently, I'll provide my feedback here.  Reading over the docs [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html) it would appear you are using the wrong condition operator modifier on [this page](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html)

Wouldn't this require that `SourceIdentity` be set to both `Saanvi` and `Diego`, not either or:
```
"StringLike": {
          "sts:SourceIdentity": [
            "Saanvi",
            "Diego"
          ]
        }
```
Shouldn't it be?:
```
"ForAnyValue:StringEquals": {
          "sts:SourceIdentity": [
            "Saanvi",
            "Diego"
          ]
        }
```
Also you appear to arbitrarily be using `StringLike` instead of `StringEquals` throughout:
```
"Condition": {
        "StringLike": {
          "sts:SourceIdentity": "${aws:username}"
        }
      }
```
Although there are no wildcards in this if you want an exact match, wouldn't it be more clear to use `StringEquals`?

Answer

Ok, I think I understand now how the first part is working. It appears that the key sts:SourceIdentity has a single value. When you use StringLike/StringEquals on a single value key and provide an array of matches, it passes if any of those items in the array are true. That is shown in an example on this page. Is it possible to explicitly document the behavior here when you use an array vs a string as a key value or point me to where that behavior is defined?.

For example:

If the key value is a string and you use StringEquals, it passes only if it matches:

"Condition": {
        "StringEquals": {
          "sts:SourceIdentity": "Saanvi"
        }
      }

If the key value is an array of strings, any one of them matching makes it pass.

"Condition": {
        StringEquals": {
          "sts:SourceIdentity": [
            "Saanvi",
            "Diego"
          ]
        }
}

perpil

answered 2 years ago

For example:

If the key value is a string and you use StringEquals, it passes only if it matches:

```
"Condition": {
        "StringEquals": {
          "sts:SourceIdentity": "Saanvi"
        }
      }
```

If the key value is an array of strings, any one of them matching makes it pass.
```
"Condition": {
        StringEquals": {
          "sts:SourceIdentity": [
            "Saanvi",
            "Diego"
          ]
        }
}
```

IAM Docs Feedback: Wrong condition operator modifier?

Relevant content