Conditions

Conditions determine the cases when the rule applies.

You can set multiple conditions for a rule and specify multiple keys for each condition. These conditions and their keys will be checked using the logical AND, i.e., the request must meet all the specified criteria at once.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": "192.168.1.1"
      }
    },
    "Condition": {
      "Bool": {
        "aws:userid": "ajelcjkv67ar********"
      }
    }
  }
}

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": "192.168.1.1",
        "aws:userid": "ajelcjkv67ar********"
      }
    }
  }
}

You can set multiple values for each condition key at the same time. These values will be checked using the logical OR, i.e., the request must match any of the specified condition key values.

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:GetObject",
    "Resource": "arn:aws:s3:::sample-bucket/*",
    "Condition": {
      "Bool": {
        "aws:sourceip": [
          "192.168.1.1",
          "192.168.1.2"
        ]
      }
    }  
  }
}

Condition operatorsCondition operators

Condition operators help verify the match between the key value in the policy condition and the its value in the request context.

Logical operatorsLogical operators

Logical operators allow you to create conditions for comparing a key against a Boolean value of true or false.

Date and time operatorsDate and time operators

Date and time operators allow you to create conditions for comparing the key with the date and time value.

IP address operatorsIP address operators

IP address operators allow you to create conditions for comparing the key with the host IP address or a range of IP addresses in CIDR format.

Numeric operatorsNumeric operators

Numeric operators allow you to create conditions for comparing the key with an integer or decimal numeric value.

String operatorsString operators

String operators allow you to create conditions for comparing the key with a string value.

IfExists operatorIfExists operator

You can append IfExists to any operator name (except Null), e.g., BoolIfExists. Using this operator in the condition element means:

• If the policy key is present in the request context, the key will be processed as specified in the policy.
• If the key is missing, the element will set to true.

Null operatorNull operator

The Null operator sets to true if a condition key is missing in the request at the time of authentication. If the key exists and its value is not null, the operator returns false.

See alsoSee also

• Debugging requests using the AWS CLI
• Example of sending a signed request using curl
• Code example for generating a signature