I'm trying to make a or condition in my IAM users but i don't know why it's not working...
I want two make a allow condition like this:
if ec2:ResourceTag/User == "${aws:username}" || ec2:ResourceTag/Group == "Dev"
I have try many things but all not works...
"StringEquals": {
"ec2:ResourceTag/User": "${aws:username}",
"ec2:ResourceTag/Group": "Dev"
}
---
"ForAnyValue:StringEquals": {
"ec2:ResourceTag/User": "${aws:username}",
"ec2:ResourceTag/Group": "Dev"
}
EDIT ---
{
"Effect": "Allow",
"Action": [
"ec2:StartInstances",
"ec2:StopInstances",
"ec2:RebootInstances",
"ec2:TerminateInstances"
],
"Resource": "*",
"Condition": {
"ForAnyValue:StringEquals": {
"ec2:ResourceTag/User": "${aws:username}",
"ec2:ResourceTag/Group": "Developers"
}
}
}
The following solution definitely works to check for distinct ResourceTag
attributes with different values as OR condition. You can always put them into separate statements. Which is of course inconvenient:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "sid1",
"Effect": "Allow",
"Action": [ ... ],
"Resource": "arn:aws:...",
"Condition": {
"StringEquals": {
"aws:ResourceTag/mytag": "myvalue"
}
}
},
{
"Sid": "sid2",
"Effect": "Allow",
"Action": [ same as in sid1 ],
"Resource": "same as in sid1",
"Condition": {
"StringEquals": {
"aws:ResourceTag/myothertag": "myothervalue"
}
}
}
]
}
I'm not aware of a solution which works with a single statement. If there is then it is not documented in AWS docs.
The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.