AWS IAM documentation change
Summary
Updated documentation links to use more descriptive anchor text 'Set operators for multivalued context keys' instead of 'Multivalued context keys' in multiple sections
Security assessment
The changes improve documentation clarity about proper use of set operators with multivalued condition keys in IAM policies. While this helps prevent policy misconfigurations, there is no evidence of addressing a specific security vulnerability. The updates enhance existing security documentation by emphasizing correct operator usage.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_condition-keys.md b/IAM/latest/UserGuide/reference_policies_condition-keys.md index 14a2ce543..a78017a15 100644 --- a//IAM/latest/UserGuide/reference_policies_condition-keys.md +++ b//IAM/latest/UserGuide/reference_policies_condition-keys.md @@ -29 +29 @@ If you use condition keys that are available only in some circumstances, you can -To compare your condition against a request context with multiple key values, you must use the `ForAllValues` or `ForAnyValue` set operators. Use set operators only with multivalued condition keys. Do not use set operators with single-valued condition keys. For more information, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +To compare your condition against a request context with multiple key values, you must use the `ForAllValues` or `ForAnyValue` set operators. Use set operators only with multivalued condition keys. Do not use set operators with single-valued condition keys. For more information, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). @@ -215 +215 @@ The following condition allows access for every principal in the `o-a1b2c3d4e5` -`aws:PrincipalOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. When you use multiple values with the `ForAnyValue` condition operator, the principal's path must match one of the paths listed in the policy. For more information about multivalued condition keys, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +`aws:PrincipalOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. When you use multiple values with the `ForAnyValue` condition operator, the principal's path must match one of the paths listed in the policy. For more information about multivalued condition keys, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). @@ -411 +411 @@ This key provides a list of all [service principal](./reference_policies_element -`aws:PrincipalServiceNamesList` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +`aws:PrincipalServiceNamesList` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). @@ -1477 +1477 @@ For additional considerations for the above unsupported actions, see the [Data P -`aws:ResourceOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +`aws:ResourceOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). @@ -2012 +2012 @@ This context key is formatted `"aws:TagKeys":"`tag-key`"` where `tag-key` is a l -Because you can include multiple tag key-value pairs in a request, the request content could be a [multivalued](./reference_policies_condition-single-vs-multi-valued-context-keys.html) request. In this case, you must use the `ForAllValues` or `ForAnyValue` set operators. For more information, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +Because you can include multiple tag key-value pairs in a request, the request content could be a [multivalued](./reference_policies_condition-single-vs-multi-valued-context-keys.html) request. In this case, you must use the `ForAllValues` or `ForAnyValue` set operators. For more information, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). @@ -2190 +2190 @@ Similarly to `aws:SourceOrgID`, to help prevent impact on service integrations t -`aws:SourceOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys). +`aws:SourceOrgPaths` is a multivalued condition key. Multivalued keys can have multiple values in the request context. You must use the `ForAnyValue` or `ForAllValues` set operators with [string condition operators](./reference_policies_elements_condition_operators.html#Conditions_String) for this key. For more information about multivalued condition keys, see [Set operators for multivalued context keys](./reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys).