AWS IAM documentation change
Summary
Updated Google organization_number condition key to google/organization_number with numeric operator support
Security assessment
Change corrects a claim name and operator type for Google identity federation. While IAM policies are security-related, this is a documentation refinement without evidence of addressing a specific vulnerability. The change ensures accurate policy configuration but doesn't introduce new security features or address known exploits.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_iam-condition-keys.md b/IAM/latest/UserGuide/reference_policies_iam-condition-keys.md index f2126277a..896168f85 100644 --- a//IAM/latest/UserGuide/reference_policies_iam-condition-keys.md +++ b//IAM/latest/UserGuide/reference_policies_iam-condition-keys.md @@ -1115 +1115 @@ AWS STS condition key | IdP JWT claim | Available in session -organization_number | organization_number | No +google/organization_number | google:organization_number | No @@ -1117 +1117 @@ organization_number | organization_number | No -**organization_number** +**google/organization_number** @@ -1120 +1120 @@ organization_number | organization_number | No -Works with [string operators](./reference_policies_elements_condition_operators.html#Conditions_String). +Works with [numeric operators](./reference_policies_elements_condition_operators.html#Conditions_Numeric). @@ -1122 +1122 @@ Works with [string operators](./reference_policies_elements_condition_operators. -**Example** – `accounts.google.com:organization_number` +**Example** – `accounts.google.com:google/organization_number` @@ -1126 +1126 @@ This key verifies that a token represents a Google identity belonging to a speci -The following example trust policy uses the `organization_number` claim to limit access to a role. +The following example trust policy uses the `google/organization_number` claim to limit access to a role. @@ -1139,2 +1139,2 @@ The following example trust policy uses the `organization_number` claim to limit - "StringEquals": { - "accounts.google.com:organization_number": "123456" + "NumericEquals": { + "accounts.google.com:google/organization_number": "123456"