AWS IAM low security documentation change
Summary
Clarified case sensitivity of tag values in aws:ResourceTag and aw:RequestTag condition keys
Security assessment
The correction addresses potential policy misconfigurations by clarifying that tag values are case-sensitive. This prevents scenarios where policies might unintentionally allow access due to case mismatch assumptions, improving access control precision.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_condition-keys.md b/IAM/latest/UserGuide/reference_policies_condition-keys.md index fd14e116c..30b52f932 100644 --- a//IAM/latest/UserGuide/reference_policies_condition-keys.md +++ b//IAM/latest/UserGuide/reference_policies_condition-keys.md @@ -1646 +1646 @@ Use this key to compare the tag key-value pair that you specify in the policy wi -This context key is formatted `"aws:ResourceTag/`tag-key`":"`tag-value`"` where `tag-key` and `tag-value` are a tag key and value pair. Tag keys and values are not case-sensitive. This means that if you specify `"aws:ResourceTag/TagKey1": "Value1"` in the condition element of your policy, then the condition matches a resource tag key named either `TagKey1` or `tagkey1`, but not both. +This context key is formatted `"aws:ResourceTag/`tag-key`":"`tag-value`"` where `tag-key` and `tag-value` are a tag key and value pair. Tag keys are not case-sensitive. This means that if you specify `"aws:ResourceTag/TagKey1": "Value1"` in the condition element of your policy, then the condition matches a resource tag key named either `TagKey1` or `tagkey1`, but not both. Values in these tag key/value pairs are case-sensitive. This means that if you specify `"aws:ResourceTag/TagKey1": "Production"` in the condition element of your policy, then the condition matches a resource tag value named `Production` but it would not match `production` or `PRODUCTION`. @@ -1971 +1971 @@ Use this key to compare the tag key-value pair that was passed in the request wi -This context key is formatted `"aws:RequestTag/`tag-key`":"`tag-value`"` where `tag-key` and `tag-value` are a tag key and value pair. Tag keys and values are not case-sensitive. This means that if you specify `"aws:RequestTag/TagKey1": "Value1"` in the condition element of your policy, then the condition matches a request tag key named either `TagKey1` or `tagkey1`, but not both. +This context key is formatted `"aws:RequestTag/`tag-key`":"`tag-value`"` where `tag-key` and `tag-value` are a tag key and value pair. Tag keys are not case-sensitive. This means that if you specify `"aws:RequestTag/TagKey1": "Value1"` in the condition element of your policy, then the condition matches a request tag key named either `TagKey1` or `tagkey1`, but not both. Values in these tag key/value pairs are case-sensitive. This means that if you specify `"aws:RequestTag/TagKey1": "Production"` in the condition element of your policy, then the condition matches a request tag value named `Production` but it would not match `production` or `PRODUCTION`.