AWS Security ChangesHomeSearch

AWS IAM documentation change

Service: IAM · 2026-02-25 · Documentation low

File: IAM/latest/UserGuide/reference_policies_iam-condition-keys.md

Summary

Updated Google organization_number condition key to google/organization_number with numeric operator support

Security assessment

Change corrects a claim name and operator type for Google identity federation. While IAM policies are security-related, this is a documentation refinement without evidence of addressing a specific vulnerability. The change ensures accurate policy configuration but doesn't introduce new security features or address known exploits.

Diff

diff --git a/IAM/latest/UserGuide/reference_policies_iam-condition-keys.md b/IAM/latest/UserGuide/reference_policies_iam-condition-keys.md
index f2126277a..896168f85 100644
--- a//IAM/latest/UserGuide/reference_policies_iam-condition-keys.md
+++ b//IAM/latest/UserGuide/reference_policies_iam-condition-keys.md
@@ -1115 +1115 @@ AWS STS condition key | IdP JWT claim | Available in session
-organization_number | organization_number | No  
+google/organization_number | google:organization_number | No  
@@ -1117 +1117 @@ organization_number | organization_number | No
-**organization_number**
+**google/organization_number**
@@ -1120 +1120 @@ organization_number | organization_number | No
-Works with [string operators](./reference_policies_elements_condition_operators.html#Conditions_String).
+Works with [numeric operators](./reference_policies_elements_condition_operators.html#Conditions_Numeric).
@@ -1122 +1122 @@ Works with [string operators](./reference_policies_elements_condition_operators.
-**Example** – `accounts.google.com:organization_number`
+**Example** – `accounts.google.com:google/organization_number`
@@ -1126 +1126 @@ This key verifies that a token represents a Google identity belonging to a speci
-The following example trust policy uses the `organization_number` claim to limit access to a role.
+The following example trust policy uses the `google/organization_number` claim to limit access to a role.
@@ -1139,2 +1139,2 @@ The following example trust policy uses the `organization_number` claim to limit
-                "StringEquals": {
-                    "accounts.google.com:organization_number": "123456"
+                "NumericEquals": {
+                    "accounts.google.com:google/organization_number": "123456"