AWS IAM medium security documentation change
Summary
Added two new condition keys (aws:CalledViaAWSMCP and aws:ViaAWSMCPService) for MCP service tracking and removed ec2:CopySnapshot from three condition key lists
Security assessment
Added MCP-specific condition keys enabling granular control over actions initiated via Managed Control Plane services. This allows policies to restrict sensitive operations (e.g., S3 bucket deletion) when initiated through MCP services, mitigating potential privilege escalation risks in multi-service architectures.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_condition-keys.md b/IAM/latest/UserGuide/reference_policies_condition-keys.md index 7090571cf..397f13534 100644 --- a//IAM/latest/UserGuide/reference_policies_condition-keys.md +++ b//IAM/latest/UserGuide/reference_policies_condition-keys.md @@ -33 +33 @@ Properties of the principal | Properties of a role session | Properties of the n -`aws:PrincipalArn` `aws:PrincipalAccount` `aws:PrincipalOrgPaths` `aws:PrincipalOrgID` `aws:PrincipalTag/tag-key` `aws:PrincipalIsAWSService` `aws:PrincipalServiceName` `aws:PrincipalServiceNamesList` `aws:PrincipalType` `aws:userid` `aws:username` | `aws:AssumedRoot` `aws:FederatedProvider` `aws:TokenIssueTime` `aws:MultiFactorAuthAge` `aws:MultiFactorAuthPresent` `aws:ChatbotSourceArn` `aws:Ec2InstanceSourceVpc` `aws:Ec2InstanceSourcePrivateIPv4` `aws:SourceIdentity` `ec2:RoleDelivery` `ec2:SourceInstanceArn` `glue:RoleAssumedBy` `glue:CredentialIssuingService` `lambda:SourceFunctionArn` `ssm:SourceInstanceArn` `identitystore:UserId` | `aws:SourceIp` `aws:SourceVpc` `aws:SourceVpcArn` `aws:SourceVpce` `aws:VpceAccount` `aws:VpceOrgID` `aws:VpceOrgPaths` `aws:VpcSourceIp` | `aws:ResourceAccount` `aws:ResourceOrgID` `aws:ResourceOrgPaths` `aws:ResourceTag/tag-key` | `aws:CalledVia` `aws:CalledViaFirst` `aws:CalledViaLast` `aws:ViaAWSService` `aws:CurrentTime` `aws:EpochTime` `aws:referer` `aws:RequestedRegion` `aws:RequestTag/tag-key` `aws:TagKeys` `aws:SecureTransport` `aws:SourceAccount` `aws:SourceArn` `aws:SourceOrgID` `aws:SourceOrgPaths` `aws:UserAgent` `aws:IsMcpServiceAction` +`aws:PrincipalArn` `aws:PrincipalAccount` `aws:PrincipalOrgPaths` `aws:PrincipalOrgID` `aws:PrincipalTag/tag-key` `aws:PrincipalIsAWSService` `aws:PrincipalServiceName` `aws:PrincipalServiceNamesList` `aws:PrincipalType` `aws:userid` `aws:username` | `aws:AssumedRoot` `aws:FederatedProvider` `aws:TokenIssueTime` `aws:MultiFactorAuthAge` `aws:MultiFactorAuthPresent` `aws:ChatbotSourceArn` `aws:Ec2InstanceSourceVpc` `aws:Ec2InstanceSourcePrivateIPv4` `aws:SourceIdentity` `ec2:RoleDelivery` `ec2:SourceInstanceArn` `glue:RoleAssumedBy` `glue:CredentialIssuingService` `lambda:SourceFunctionArn` `ssm:SourceInstanceArn` `identitystore:UserId` | `aws:SourceIp` `aws:SourceVpc` `aws:SourceVpcArn` `aws:SourceVpce` `aws:VpceAccount` `aws:VpceOrgID` `aws:VpceOrgPaths` `aws:VpcSourceIp` | `aws:ResourceAccount` `aws:ResourceOrgID` `aws:ResourceOrgPaths` `aws:ResourceTag/tag-key` | `aws:CalledVia` `aws:CalledViaFirst` `aws:CalledViaLast` `aws:CalledViaAWSMCP` `aws:ViaAWSService` `aws:ViaAWSMCPService` `aws:CurrentTime` `aws:EpochTime` `aws:referer` `aws:RequestedRegion` `aws:RequestTag/tag-key` `aws:TagKeys` `aws:SecureTransport` `aws:SourceAccount` `aws:SourceArn` `aws:SourceOrgID` `aws:SourceOrgPaths` `aws:UserAgent` `aws:IsMcpServiceAction` @@ -1787,2 +1786,0 @@ Use this key to compare the requested resource owner's [AWS account ID](https:// - * `ec2:CopySnapshot` - @@ -1920,2 +1917,0 @@ Use this key to compare the AWS Organizations path for the accessed resource to - * `ec2:CopySnapshot` - @@ -2026,2 +2021,0 @@ Use this key to compare the identifier of the organization in AWS Organizations - * `ec2:CopySnapshot` - @@ -2275,0 +2270,74 @@ The request context key returns `true` when a service uses forward access sessio +### aws:CalledViaAWSMCP + +Use this key to compare the services in the policy with the AWS MCP services that made requests on behalf of the IAM principal (user or role). When a principal makes a request to an AWS MCP service, that service uses the principal's credentials to make subsequent requests to other services. When the request is made using an AWS MCP service, this key is set with the value of the service principal. The `aws:CalledViaAWSMCP` key contains the service principal name of the MCP service that made requests on the principal's behalf. + + * **Availability** – This key is present in the request when an AWS MCP service uses the credentials of an IAM principal to make a request to an AWS service. This key is also not present when the principal makes the call directly. + + * **Data type** – [String](./reference_policies_elements_condition_operators.html#Conditions_String) + + * **Value type** – Single-valued + + + + +You can use this condition key to allow or deny access based on which specific MCP server initiated the request. For example, the following policy denies sensitive delete operations when they are initiated through a specific MCP server: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "DenySensitiveActionsViaSpecificMCP", + "Effect": "Deny", + "Action": [ + "s3:DeleteBucket", + "s3:DeleteObject", + "dynamodb:DeleteTable" + ], + "Resource": "*", + "Condition": { + "StringEquals": { + "aws:CalledViaAWSMCP": "aws-mcp.amazonaws.com" + } + } + } + ] + } + +### aws:ViaAWSMCPService + +Use this key to check whether an AWS MCP service makes a request to another AWS service on your behalf using forward access sessions (FAS). The request context key returns `true` when an AWS MCP service forwards a request to an AWS service on behalf of the original IAM principal. The request context key also returns `false` when the principal makes the call directly. + + * **Availability** – This key is included in the request context when an AWS MCP server makes a request to a downstream AWS service on behalf of an IAM principal. + + * **Data type** – [Boolean](./reference_policies_elements_condition_operators.html#Conditions_Boolean) + + * **Value type** – Single-valued + + + + +You can use this key to restrict specific actions when they come through MCP servers. For example, the following policy denies sensitive delete operations when initiated through any AWS MCP server: + + + { + "Version": "2012-10-17", + "Statement": [ + { + "Sid": "DenySensitiveActionsViaMCP", + "Effect": "Deny", + "Action": [ + "s3:DeleteBucket", + "s3:DeleteObject", + "dynamodb:DeleteTable" + ], + "Resource": "*", + "Condition": { + "Bool": { + "aws:ViaAWSMCPService": "true" + } + } + } + ] + } +