DOC: Create new IAM Policy Grammar Page - #799
Conversation
…soft Entra ID (#722) Co-authored-by: Brian Rinaldi <brian.rinaldi@gmail.com>
…nedPollerConfig, FunctionResponseTypes) (#750) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…th Microsoft Entra ID" (#775)
Add a reference page listing the condition operators and condition keys the LocalStack IAM policy engine evaluates. Covers the newly supported numeric operators, negated string operators, and negated ARN operators, plus the iam:PolicyArn and s3:max-keys condition keys, with a worked s3:max-keys example. Operators whose support is not yet confirmed are marked as pending a check against the policy engine.
| order: 5 | ||
| --- | ||
|
|
||
| <!-- |
There was a problem hiding this comment.
hey @blkgrlcto there are several notes here mentioning this being in draft mode. Also several parts where it says TO DO. Is this ready to review or should we move this PR to draft mode?
| | `StringEquals` | Verify | | ||
| | `StringNotEquals` | Yes | | ||
| | `StringEqualsIgnoreCase` | Verify | | ||
| | `StringNotEqualsIgnoreCase` | Yes | | ||
| | `StringLike` | Verify | | ||
| | `StringNotLike` | Yes | |
| | `ArnLike` | Verify | | ||
| | `ArnNotEquals` | Yes | | ||
| | `ArnNotLike` | Yes | | ||
|
|
| IpAddress / NotIpAddress, Null — plus the `...IfExists` variants and the | ||
| ForAllValues / ForAnyValue set operators. Support unknown; confirm against source. | ||
| --> | ||
|
|
There was a problem hiding this comment.
Full list of supported operators are here: https://github.com/localstack/localstack-pro/blob/09fb6de8337f5a633110f8486abc49d5260ddb84/localstack-pro-core/localstack/pro/core/services/iam/policy_engine/engine.py#L1387
AWS documentation at https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition_operators.html
| | `iam:PolicyArn` | Restrict policy attach/detach operations to specific policies. | | ||
| | `s3:max-keys` | Numeric key for the maximum number of keys returned by a listing. | | ||
|
|
||
| <!-- VERIFY: whether global aws:* keys warrant their own row/subsection or a support note. --> |
There was a problem hiding this comment.
list of supported service condition keys can be identified as follows:
In service modules in localstack-pro-core/localstack/pro/core/services/, there is an iam.py file. This file has a function get_iam_context() which determines the context key. The function sets these keys to the iam_context dict.
Take ec2 for example, some of the keys determines here are:
- ec2:metadatahttptokens
- ec2:metadatahttpputresponsehoplimit
- ec2:attribute/...
- aws:tagkeys
- aws:RequestTag/...
Summary
Adds a new IAM Policy Grammar reference page under Security Testing,
documenting the condition operators and condition keys the LocalStack IAM
policy engine can evaluate. The same engine backs IAM Policy Enforcement
and the IAM Policy Simulator, so the page applies to both.
New page:
src/content/docs/aws/capabilities/security-testing/iam-policy-grammar.mdDocuments: localstack-pro#7232, localstack-pro#7209
Closes: DOC-276, DOC-277
Contents
Confirmed as supported: the six numeric operators, the negated string
operators (
StringNotEquals,StringNotEqualsIgnoreCase,StringNotLike),and the negated ARN operators (
ArnNotEquals,ArnNotLike).iam:PolicyArnands3:max-keys.s3:max-keysnumeric guardrail.Draft — blockers before this can merge
Verifyin the String and ARNtables (
StringEquals,StringEqualsIgnoreCase,StringLike,ArnEquals,ArnLike) and the entire "Other categories" set (Date, Bool, BinaryEquals,IpAddress/NotIpAddress, Null, the
...IfExistsvariants, andForAllValues/ForAnyValue) need confirming against the policy engine. The
release notes only tell us what was added, not the complete supported set.
tagstier andsidebar.orderrelative to theother Security Testing pages.
s3:max-keysexample end-to-end underENFORCE_IAM=1.Reviewer notes
DRAFTheader andVERIFYmarkers) must beremoved before merge.
(tracked separately as DOC-302). Either land that first or drop the two links
to it until it exists.
Out of scope
separate ticket and intentionally not documented here.