Conditions

Conditions determine the cases in which the rule applies.

You can set multiple conditions for a rule and specify multiple keys for each one. These conditions and their keys will be checked using the AND logic. This means the request must meet all the specified criteria at once.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": "192.168.1.1"
      }
    },
    "Condition": {
      "Bool": {
        "aws:userid": "ajelcjkv67ar********"
      }
    }
  }
}

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": "192.168.1.1",
        "aws:userid": "ajelcjkv67ar********"
      }
    }
  }
}

You can set multiple values for each condition key at the same time. These values will be checked using the OR logic. This means the request must match any of the specified condition key values.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": [
          "192.168.1.1",
          "192.168.1.2"
        ]
      }
    }  
  }
}

Condition operatorsCondition operators

Condition operators are used to verify the conformity between the key value in the policy condition and the its value in the request context.

Logical operatorsLogical operators

Logical operators allow you to you create conditions for comparing a key against a Boolean value of true or false.

Date and time operatorsDate and time operators

Date and time operators let you create conditions for matching the key against the value of the date and time.

IP address operatorsIP address operators

IP statements allow you to create conditions for matching the key against the host IP or a range of IP addresses in CIDR format.

Numeric operatorsNumeric operators

Numeric operators let you create conditions for matching the key against an integer or decimal numeric value.

String operatorsString operators

String operators allow creating conditions for comparing a key against a string value.

IfExists operatorIfExists operator

You can append IfExists to any operator name (except Null), e.g., BoolIfExists. Using this operator in the condition element means:

• If the policy key is present in the request context, process the key as specified in the policy.
• If the key is missing, the element will return true.

Null operatorNull operator

The Null operator returns true if a condition key is missing in the request at the time of authentication. If the key exists and its value is not null, the operator returns false.

See alsoSee also

• Debugging requests using the AWS CLI
• Example of sending a signed request using curl
• Example of signature generation code