IAM 정책 검증 검사 참조

IAM 정책 검증 검사 참조

IAM Access Analyzer 정책 검증이 실행하는 기본 정책 검사 목록과 각 검사의 이슈 코드, 결과 유형, 해결 방법을 정리한 참조 문서입니다. 정책을 AWS CLI·API·IAM 콘솔 JSON 정책 편집기로 만들거나 편집할 때 IAM Access Analyzer가 정책 문법과 AWS 모범 사례에 대해 정책을 검증해 보안 경고·오류·일반 경고·제안을 보고합니다.

출처: 문서

본문

IAM policy validation check reference - AWS Identity and Access Management

IAM policy validation check reference

You can validate your policies using AWS Identity and Access Management Access Analyzer policy validation. You can create or edit a policy using the AWS CLI, AWS API, or JSON policy editor in the IAM console. IAM Access Analyzer validates your policy against IAM policy grammar and AWS best practices. You can view policy validation check findings that include security warnings, errors, general warnings, and suggestions for your policy. These findings provide actionable recommendations that help you author policies that are functional and conform to security best practices. The list of basic policy checks provided by IAM Access Analyzer are shared below. There is no additional charge associated with running the policy validation checks. To learn more about validating policies using policy validation, see Validate policies with IAM Access Analyzer.

Error – ARN account not allowed

Issue code: ARN_ACCOUNT_NOT_ALLOWED Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

ARN account not allowed: The service {{service}} does not support specifying an account ID in the resource ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The service {{service}} does not support specifying an account ID in the resource ARN."

오류 해결 Remove the account ID from the resource ARN. The resource ARNs for some AWS services do not support specifying an account ID. For example, Amazon S3 does not support an account ID as a namespace in bucket ARNs. An Amazon S3 bucket name is globally unique, and the namespace is shared by all AWS accounts. To view all of the resource types available in Amazon S3, see Resource types defined by Amazon S3 in the Service Authorization Reference. 관련 용어

Policy resources

Account Identifiers

Resource ARNs

AWS service resources with ARN formats

Error – ARN Region not allowed

Issue code: ARN_REGION_NOT_ALLOWED Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

ARN Region not allowed: The service {{service}} does not support specifying a Region in the resource ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The service {{service}} does not support specifying a Region in the resource ARN."

오류 해결 Remove the Region from the resource ARN. The resource ARNs for some AWS services do not support specifying a Region. For example, IAM is a global service. The Region portion of an IAM resource ARN is always kept blank. IAM resources are global, like an AWS account is today. For example, after you sign in as an IAM user, you can access AWS services in any geographic region.

Policy resources

Resource ARNs

AWS service resources with ARN formats

Error – Data type mismatch

Issue code: DATA_TYPE_MISMATCH Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Data type mismatch: The text does not match the expected JSON data type {{data_type}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The text does not match the expected JSON data type {{data_type}}."

오류 해결 Update the text to use the supported data type. For example, the Version global condition key requires a String data type. If you provide a date or an integer, the data type won't match. 관련 용어

Global condition keys

IAM JSON policy elements: Condition operators

Error – Duplicate keys with different case

Issue code: DUPLICATE_KEYS_WITH_DIFFERENT_CASE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Duplicate keys with different case: The condition key {{key}} appears more than once with different capitalization in the same condition block. Remove the duplicate condition keys.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{key}} appears more than once with different capitalization in the same condition block. Remove the duplicate condition keys."

오류 해결 Review the similar condition keys within the same condition block and use the same capitalization for all instances. A condition block is the text within the Condition element of a policy statement. Condition key names are not case-sensitive. The case-sensitivity of condition key values depends on the condition operator that you use. For more information about case-sensitivity in condition keys, see IAM JSON policy elements: Condition. 관련 용어

Conditions

Condition block

Global condition keys

AWS service condition keys

Error – Invalid action

Issue code: INVALID_ACTION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid action: The action {{action}} does not exist. Did you mean {{valid_action}}?

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The action {{action}} does not exist. Did you mean {{valid_action}}?"

오류 해결 The action that you specified is not valid. This can happen if you mis-type the service prefix or the action name. For some common issues, the policy check returns a suggested action. 관련 용어

Policy actions

AWS service actions

AWS managed policies with this error

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. The following AWS managed policies include invalid actions in their policy statements. Invalid actions do not affect the permissions granted by the policy. When using an AWS managed policy as a reference to create your managed policy, AWS recommends that you remove invalid actions from your policy.

AmazonEMRFullAccessPolicy_v2

CloudWatchSyntheticsFullAccess

Error – Invalid ARN account

Issue code: INVALID_ARN_ACCOUNT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid ARN account: The resource ARN account ID {{account}} is not valid. Provide a 12-digit account ID.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The resource ARN account ID {{account}} is not valid. Provide a 12-digit account ID."

오류 해결 Update the account ID in the resource ARN. Account IDs are 12-digit integers. To learn how to view your account ID, see Finding your AWS account ID. 관련 용어

Policy resources

Account Identifiers

Resource ARNs

AWS service resources with ARN formats

Error – Invalid ARN prefix

Issue code: INVALID_ARN_PREFIX Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid ARN prefix: Add the required prefix (arn) to the resource ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add the required prefix (arn) to the resource ARN."

오류 해결 AWS resource ARNs must include the required arn: prefix. 관련 용어

Policy resources

Resource ARNs

AWS service resources with ARN formats

Error – Invalid ARN Region

Issue code: INVALID_ARN_REGION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid ARN Region: The Region {{region}} is not valid for this resource. Update the resource ARN to include a supported Region.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Region {{region}} is not valid for this resource. Update the resource ARN to include a supported Region."

오류 해결 The resource type is not supported in the specified Region. For a table of AWS services supported in each Region, see the Region table. 관련 용어

Policy resources

Resource ARNs

Region names and codes

Error – Invalid ARN resource

Issue code: INVALID_ARN_RESOURCE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid ARN resource: Resource ARN does not match the expected ARN format. Update the resource portion of the ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Resource ARN does not match the expected ARN format. Update the resource portion of the ARN."

오류 해결 The resource ARN must match the specifications for known resource types. To view the expected ARN format for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view its resource types and ARN formats. 관련 용어

Policy resources

Resource ARNs

AWS service resources with ARN formats

Error – Invalid ARN service case

Issue code: INVALID_ARN_SERVICE_CASE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid ARN service case: Update the service name {{service}} in the resource ARN to use all lowercase letters.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Update the service name {{service}} in the resource ARN to use all lowercase letters."

오류 해결 The service in the resource ARN must match the specifications (including capitalization) for service prefixes. To view the prefix for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service and locate its prefix in the first sentence. 관련 용어

Policy resources

Resource ARNs

AWS service resources with ARN formats

Error – Invalid condition data type

Issue code: INVALID_CONDITION_DATA_TYPE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid condition data type: The condition value data types do not match. Use condition values of the same JSON data type.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition value data types do not match. Use condition values of the same JSON data type."

오류 해결 The value in the condition key-value pair must match the data type of the condition key and condition operator. To view the condition key data type for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service. For example, the CurrentTime global condition key supports the Date condition operator. If you provide a string or an integer for the value in the condition block, the data type won't match. 관련 용어

Conditions

Condition block

IAM JSON policy elements: Condition operators

Global condition keys

AWS service condition keys

Error – Invalid condition key format

Issue code: INVALID_CONDITION_KEY_FORMAT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid condition key format: The condition key format is not valid. Use the format service:keyname.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key format is not valid. Use the format service:keyname."

오류 해결 The key in the condition key-value pair must match the specifications for the service. To view the condition keys for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service. 관련 용어

Conditions

Global condition keys

AWS service condition keys

Error – Invalid condition multiple Boolean

Issue code: INVALID_CONDITION_MULTIPLE_BOOLEAN Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid condition multiple Boolean: The condition key does not support multiple Boolean values. Use a single Boolean value.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key does not support multiple Boolean values. Use a single Boolean value."

오류 해결 The key in the condition key-value pair expects a single Boolean value. When you provide multiple Boolean values, the condition match might not return the results that you expect. To view the condition keys for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service.

Conditions

Global condition keys

AWS service condition keys

Error – Invalid condition operator

Issue code: INVALID_CONDITION_OPERATOR Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid condition operator: The condition operator {{operator}} is not valid. Use a valid condition operator.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition operator {{operator}} is not valid. Use a valid condition operator."

오류 해결 Update the condition to use a supported condition operator. 관련 용어

IAM JSON policy elements: Condition operators

Condition element

Overview of JSON policies

Error – Invalid effect

Issue code: INVALID_EFFECT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid effect: The effect {{effect}} is not valid. Use Allow or Deny.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The effect {{effect}} is not valid. Use Allow or Deny."

오류 해결 Update the Effect element to use a valid effect. Valid values for Effect are Allow and Deny. 관련 용어

Effect element

Overview of JSON policies

Error – Invalid global condition key

Issue code: INVALID_GLOBAL_CONDITION_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid global condition key: The condition key {{key}} does not exist. Use a valid condition key.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{key}} does not exist. Use a valid condition key."

오류 해결 Update the condition key in the condition key-value pair to use a supported global condition key. Global condition keys are condition keys with an aws: prefix. AWS services can support global condition keys or provide service-specific keys that include their service prefix. For example, IAM condition keys include the iam: prefix. For more information, see Actions, Resources, and Condition Keys for AWS Services and choose the service whose keys you want to view. 관련 용어

Global condition keys

Error – Invalid partition

Issue code: INVALID_PARTITION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid partition: The resource ARN for the service {{service}} does not support the partition {{partition}}. Use the supported values: {{partitions}}

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The resource ARN for the service {{service}} does not support the partition {{partition}}. Use the supported values: {{partitions}}"

오류 해결 Update the resource ARN to include a supported partition. If you included a supported partition, then the service or resource might not support the partition that you included. A partition is a group of AWS Regions. Each AWS account is scoped to one partition. In Classic Regions, use the aws partition. In China Regions, use aws-cn. 관련 용어

Amazon Resource Names (ARNs) - Partitions

Error – Invalid policy element

Issue code: INVALID_POLICY_ELEMENT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid policy element: The policy element {{element}} is not valid.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy element {{element}} is not valid."

오류 해결 Update the policy to include only supported JSON policy elements. 관련 용어

JSON policy elements

Error – Invalid principal format

Issue code: INVALID_PRINCIPAL_FORMAT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid principal format: The Principal element contents are not valid. Specify a key-value pair in the Principal element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Principal element contents are not valid. Specify a key-value pair in the Principal element."

오류 해결 Update the principal to use a supported key-value pair format. You can specify a principal in a resource-based policy, but not an identity-based policy. For example, to define access for everyone in an AWS account, use the following principal in your policy:

"Principal": { "AWS": "123456789012" }

관련 용어

JSON policy elements: Principal

Identity-based policies and resource-based policies

Error – Invalid principal key

Issue code: INVALID_PRINCIPAL_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid principal key: The principal key {{principal-key}} is not valid.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The principal key {{principal-key}} is not valid."

오류 해결 Update the key in the principal key-value pair to use a supported principal key. The following are supported principal keys:

AWS

CanonicalUser

Federated

Service 관련 용어

Principal element

Error – Invalid Region

Issue code: INVALID_REGION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid Region: The Region {{region}} is not valid. Update the condition value to a supported Region.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Region {{region}} is not valid. Update the condition value to a supported Region."

오류 해결 Update the value of the condition key-value pair to include a supported Region. For a table of AWS services supported in each Region, see the Region table. 관련 용어

Policy resources

Resource ARNs

Region names and codes

Error – Invalid service

Issue code: INVALID_SERVICE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid service: The service {{service}} does not exist. Use a valid service name.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The service {{service}} does not exist. Use a valid service name."

오류 해결 The service prefix in the action or condition key must match the specifications (including capitalization) for service prefixes. To view the prefix for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service and locate its prefix in the first sentence. 관련 용어

Known services and their actions, resources, and condition keys

Error – Invalid service condition key

Issue code: INVALID_SERVICE_CONDITION_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid service condition key: The condition key {{key}} does not exist in the service {{service}}. Use a valid condition key.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{key}} does not exist in the service {{service}}. Use a valid condition key."

오류 해결 Update the key in the condition key-value pair to use a known condition key for the service. Global condition key names begin with the aws prefix. AWS services can provide service-specific keys that include their service prefix. To view the prefix for a service, see Actions, resources, and condition keys for AWS services. 관련 용어

Global condition keys

Known services and their actions, resources, and condition keys

Error – Invalid service in action

Issue code: INVALID_SERVICE_IN_ACTION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid service in action: The service {{service}} specified in the action does not exist. Did you mean {{service2}}?

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The service {{service}} specified in the action does not exist. Did you mean {{service2}}?"

오류 해결 The service prefix in the action must match the specifications (including capitalization) for service prefixes. To view the prefix for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service and locate its prefix in the first sentence. 관련 용어

Action element

Known services and their actions

Error – Invalid variable for operator

Issue code: INVALID_VARIABLE_FOR_OPERATOR Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid variable for operator: Policy variables can only be used with String and ARN operators.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Policy variables can only be used with String and ARN operators."

오류 해결 You can use policy variables in the Resource element and in string comparisons in the Condition element. Conditions support variables when you use string operators or ARN operators. String operators include StringEquals, StringLike, and StringNotLike. ARN operators include ArnEquals and ArnLike. You can't use a policy variable with other operators, such as Numeric, Date, Boolean, Binary, IP Address, or Null operators. 관련 용어

Using policy variables in the Condition element

Condition element

Error – Invalid version

Issue code: INVALID_VERSION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid version: The version {{version}} is not valid. Use one of the following versions: {{versions}}

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The version {{version}} is not valid. Use one of the following versions: {{versions}}"

오류 해결 The Version policy element specifies the language syntax rules that AWS uses to process a policy. To use all of the available policy features, include the latest Version element before the Statement element in all of your policies.

"Version": "2012-10-17"

관련 용어

Version element

Error – Json syntax error

Issue code: JSON_SYNTAX_ERROR Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Json syntax error: Fix the JSON syntax error at index {{index}} line {{line}} column {{column}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Fix the JSON syntax error at index {{index}} line {{line}} column {{column}}."

오류 해결 Your policy includes a syntax error. Check your JSON syntax. 관련 용어

JSON validator

IAM JSON policy elements reference

Overview of JSON policies

Error – Json syntax error

Issue code: JSON_SYNTAX_ERROR Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Json syntax error: Fix the JSON syntax error.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Fix the JSON syntax error."

오류 해결 Your policy includes a syntax error. Check your JSON syntax. 관련 용어

JSON validator

IAM JSON policy elements reference

Overview of JSON policies

Error – Missing action

Issue code: MISSING_ACTION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing action: Add an Action or NotAction element to the policy statement.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add an Action or NotAction element to the policy statement."

오류 해결 AWS JSON policies must include an Action or NotAction element. 관련 용어

Action element

NotAction element

Overview of JSON policies

Error – Missing ARN field

Issue code: MISSING_ARN_FIELD Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing ARN field: Resource ARNs must include at least {{fields}} fields in the following structure: arn:partition:service:region:account:resource

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Resource ARNs must include at least {{fields}} fields in the following structure: arn:partition:service:region:account:resource"

오류 해결 All of the fields in the resource ARN must match the specifications for a known resource type. To view the expected ARN format for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view its resource types and ARN formats. 관련 용어

Policy resources

Resource ARNs

AWS service resources with ARN formats

Error – Missing ARN Region

Issue code: MISSING_ARN_REGION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing ARN Region: Add a Region to the {{service}} resource ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a Region to the {{service}} resource ARN."

오류 해결 The resource ARNs for most AWS services require that you specify a Region. For a table of AWS services supported in each Region, see the Region table. 관련 용어

Policy resources

Resource ARNs

Region names and codes

Error – Missing effect

Issue code: MISSING_EFFECT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing effect: Add an Effect element to the policy statement with a value of Allow or Deny.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add an Effect element to the policy statement with a value of Allow or Deny."

오류 해결 AWS JSON policies must include an Effect element with a value of Allow and Deny. 관련 용어

Effect element

Overview of JSON policies

Error – Missing principal

Issue code: MISSING_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing principal: Add a Principal element to the policy statement.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a Principal element to the policy statement."

오류 해결 Resource-based policies must include a Principal element. For example, to define access for everyone in an AWS account, use the following principal in your policy:

"Principal": { "AWS": "123456789012" }

관련 용어

Principal element

Identity-based policies and resource-based policies

Error – Missing qualifier

Issue code: MISSING_QUALIFIER Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing qualifier: The request context key {{key}} has multiple values. Use the ForAllValues or ForAnyValue condition key qualifiers in your policy.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The request context key {{key}} has multiple values. Use the ForAllValues or ForAnyValue condition key qualifiers in your policy."

오류 해결 In the Condition element, you build expressions in which you use condition operators like equal or less than to compare a condition in the policy against keys and values in the request context. For requests that include multiple values for a single condition key, you must enclose the conditions within brackets like an array ("Key2":["Value2A", "Value2B"]). You must also use the ForAllValues or ForAnyValue set operators with the StringLike condition operator. These qualifiers add set-operation functionality to the condition operator so that you can test multiple request values against multiple condition values. 관련 용어

Multivalued context keys

Condition element

AWS managed policies with this error

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. The following AWS managed policies include a missing qualifier for condition keys in their policy statements. When using the AWS managed policy as a reference to create your customer managed policy, AWS recommends that you add the ForAllValues or ForAnyValue condition key qualifiers to your Condition element.

AWSGlueConsoleSageMakerNotebookFullAccess

Error – Missing resource

Issue code: MISSING_RESOURCE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing resource: Add a Resource or NotResource element to the policy statement.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a Resource or NotResource element to the policy statement."

오류 해결 All policies except role trust policies must include a Resource or NotResource element. 관련 용어

Resource element

NotResource element

Identity-based policies and resource-based policies

Overview of JSON policies

Error – Missing statement

Issue code: MISSING_STATEMENT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing statement: Add a statement to the policy

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a statement to the policy"

오류 해결 A JSON policy must include a statement. 관련 용어

JSON policy elements

Error – Null with if exists

Issue code: NULL_WITH_IF_EXISTS Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Null with if exists: The Null condition operator cannot be used with the IfExists suffix. Update the operator or the suffix.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Null condition operator cannot be used with the IfExists suffix. Update the operator or the suffix."

오류 해결 You can add IfExists to the end of any condition operator name except the Null condition operator. Use a Null condition operator to check if a condition key is present at the time of authorization. Use ...ifExists to say "If the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, evaluate the condition element as true." 관련 용어

...IfExists condition operators

Null condition operator

Condition element

Error – SCP syntax error action wildcard

Issue code: SCP_SYNTAX_ERROR_ACTION_WILDCARD Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

SCP syntax error action wildcard: SCP actions can include wildcards (*) only at the end of a string. Update {{action}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "SCP actions can include wildcards (*) only at the end of a string. Update {{action}}."

오류 해결 AWS Organizations service control policies (SCPs) support specifying values in the Action or NotAction elements. However, these values can include wildcards (*) only at the end of the string. This means that you can specify iam:Get* but not iam:*role. To specify multiple actions, AWS recommends that you list them individually. 관련 용어

SCP Action and NotAction elements

SCP evaluation

AWS Organizations service control policies

IAM JSON policy elements: Action

Error – SCP syntax error principal

Issue code: SCP_SYNTAX_ERROR_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

SCP syntax error principal: SCPs do not support specifying principals. Remove the Principal or NotPrincipal element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "SCPs do not support specifying principals. Remove the Principal or NotPrincipal element."

오류 해결 AWS Organizations service control policies (SCPs) do not support the Principal or NotPrincipal elements. You can specify the Amazon Resource Name (ARN) using the aws:PrincipalArn global condition key in the Condition element. 관련 용어

SCP syntax

Global condition keys for principals

Error – Unique Sids required

Issue code: UNIQUE_SIDS_REQUIRED Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unique Sids required: Duplicate statement IDs are not supported for this policy type. Update the Sid value.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Duplicate statement IDs are not supported for this policy type. Update the Sid value."

오류 해결 For some policy types, statement IDs must be unique. The Sid (statement ID) element allows you to enter an optional identifier that you provide for the policy statement. You can assign a statement ID value to each statement in a statement array using the SID element. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. For example, in IAM, the Sid value must be unique within a JSON policy. 관련 용어

IAM JSON policy elements: Sid

Error – Unsupported action in policy

Issue code: UNSUPPORTED_ACTION_IN_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported action in policy: The action {{action}} is not supported for the resource-based policy attached to the resource type {{resourceType}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The action {{action}} is not supported for the resource-based policy attached to the resource type {{resourceType}}."

오류 해결 Some actions aren't supported in the Action element in the resource-based policy attached to a different resource type. For example, AWS Key Management Service actions aren't supported in Amazon S3 bucket policies. Specify an action that is supported by resource type attached to your resource-based policy. 관련 용어

JSON policy elements: Action

Error – Unsupported element combination

Issue code: UNSUPPORTED_ELEMENT_COMBINATION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported element combination: The policy elements {{element1}} and {{element2}} can not be used in the same statement. Remove one of these elements.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy elements {{element1}} and {{element2}} can not be used in the same statement. Remove one of these elements."

오류 해결 Some combinations of JSON policy elements can't be used together. For example, you cannot use both Action and NotAction in the same policy statement. Other pairs that are mutually exclusive include Principal/NotPrincipal and Resource/NotResource. 관련 용어

IAM JSON policy elements reference

Overview of JSON policies

Error – Unsupported global condition key

Issue code: UNSUPPORTED_GLOBAL_CONDITION_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported global condition key: The condition key aws:ARN is not supported. Use aws:PrincipalArn or aws:SourceArn instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key aws:ARN is not supported. Use aws:PrincipalArn or aws:SourceArn instead."

오류 해결 AWS does not support using the specified global condition key. Depending on your use case, you can use the aws:PrincipalArn or aws:SourceArn global condition keys. For example, instead of aws:ARN, use the aws:PrincipalArn to compare the Amazon Resource Name (ARN) of the principal that made the request with the ARN that you specify in the policy. Alternatively, use the aws:SourceArn global condition key to compare the Amazon Resource Name (ARN) of the resource making a service-to-service request with the ARN that you specify in the policy. 관련 용어

AWS global condition context keys

Error – Unsupported principal

Issue code: UNSUPPORTED_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported principal: The policy type {{policy_type}} does not support the Principal element. Remove the Principal element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy type {{policy_type}} does not support the Principal element. Remove the Principal element."

오류 해결 The Principal element specifies the principal that is allowed or denied access to a resource. You cannot use the Principal element in an IAM identity-based policy. You can use it in the trust policies for IAM roles and in resource-based policies. Resource-based policies are policies that you embed directly in a resource. For example, you can embed policies in an Amazon S3 bucket or an AWS KMS key. 관련 용어

AWS JSON policy elements: Principal

Cross account resource access in IAM

Error – Unsupported resource ARN in policy

Issue code: UNSUPPORTED_RESOURCE_ARN_IN_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported resource ARN in policy: The resource ARN is not supported for the resource-based policy attached to the resource type {{resourceType}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The resource ARN is not supported for the resource-based policy attached to the resource type {{resourceType}}."

오류 해결 Some resource ARNs aren't supported in the Resource element of the resource-based policy when the policy is attached to a different resource type. For example, AWS KMS ARNs aren't supported in the Resource element for Amazon S3 bucket policies. Specify a resource ARN that is supported by a resource type attached to your resource-based policy. 관련 용어

JSON policy elements: Action

Error – Unsupported Sid

Issue code: UNSUPPORTED_SID Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported Sid: Update the characters in the Sid element to use one of the following character types: [a-z, A-Z, 0-9]

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Update the characters in the Sid element to use one of the following character types: [a-z, A-Z, 0-9]"

오류 해결 The Sid element supports uppercase letters, lowercase letters, and numbers. 관련 용어

IAM JSON policy elements: Sid

Error – Unsupported wildcard in principal

Issue code: UNSUPPORTED_WILDCARD_IN_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported wildcard in principal: Wildcards (*, ?) are not supported with the principal key {{principal_key}}. Replace the wildcard with a valid principal value.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Wildcards (*, ?) are not supported with the principal key {{principal_key}}. Replace the wildcard with a valid principal value."

오류 해결 The Principal element structure supports using a key-value pair. The principal value specified in the policy includes a wildcard (*). You can't include a wildcard with the principal key that you specified. For example, when you specify users in a Principal element, you cannot use a wildcard to mean "all users". You must name a specific user or users. Similarly, when you specify an assumed-role session, you cannot use a wildcard to mean "all sessions". You must name a specific session. You also cannot use a wildcard to match part of a name or an ARN. To resolve this finding, remove the wildcard and provide a more specific principal. 관련 용어

AWS JSON policy elements: Principal

Error – Missing brace in variable

Issue code: MISSING_BRACE_IN_VARIABLE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing brace in variable: The policy variable is missing a closing curly brace. Add } after the variable text.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy variable is missing a closing curly brace. Add } after the variable text."

오류 해결 Policy variable structure supports using a $ prefix followed by a pair of curly braces ({ }). Inside the ${ } characters, include the name of the value from the request that you want to use in the policy. To resolve this finding, add the missing brace to make sure the full opening and closing set of braces is present. 관련 용어

IAM policy elements: Variables

Error – Missing quote in variable

Issue code: MISSING_QUOTE_IN_VARIABLE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing quote in variable: The policy variable default value must begin and end with a single quote. Add the missing quote.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy variable default value must begin and end with a single quote. Add the missing quote."

오류 해결 When you add a variable to your policy, you can specify a default value for the variable. If a variable is not present, AWS uses the default text that you provide. To add a default value to a variable, surround the default value with single quotes (' '), and separate the variable text and the default value with a comma and space (, ). For example, if a principal is tagged with team=yellow, they can access the amzn-s3-demo-bucket Amazon S3 bucket with the name amzn-s3-demo-bucket-yellow. A policy with this resource might allow team members to access their own resources, but not those of other teams. For users without team tags, you might set a default value of company-wide. These users can access only the amzn-s3-demo-bucket-company-wide bucket where they can view broad information, such as instructions for joining a team.

"Resource":"arn:aws:s3:::amzn-s3-demo-bucket-${aws:PrincipalTag/team, 'company-wide'}"

관련 용어

IAM policy elements: Variables

Error – Unsupported space in variable

Issue code: UNSUPPORTED_SPACE_IN_VARIABLE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported space in variable: A space is not supported within the policy variable text. Remove the space.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "A space is not supported within the policy variable text. Remove the space."

오류 해결 Policy variable structure supports using a $ prefix followed by a pair of curly braces ({ }). Inside the ${ } characters, include the name of the value from the request that you want to use in the policy. Although you can include a space when you specify a default variable, you cannot include a space in the variable name. 관련 용어

IAM policy elements: Variables

Error – Empty variable

Issue code: EMPTY_VARIABLE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty variable: Empty policy variable. Remove the ${ } variable structure or provide a variable within the structure.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Empty policy variable. Remove the ${ } variable structure or provide a variable within the structure."

오류 해결 Policy variable structure supports using a $ prefix followed by a pair of curly braces ({ }). Inside the ${ } characters, include the name of the value from the request that you want to use in the policy. 관련 용어

IAM policy elements: Variables

Error – Variable unsupported in element

Issue code: VARIABLE_UNSUPPORTED_IN_ELEMENT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Variable unsupported in element: Policy variables are supported in the Resource and Condition elements. Remove the policy variable {{variable}} from this element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Policy variables are supported in the Resource and Condition elements. Remove the policy variable {{variable}} from this element."

오류 해결 You can use policy variables in the Resource element and in string comparisons in the Condition element. 관련 용어

IAM policy elements: Variables

Error – Variable unsupported in version

Issue code: VARIABLE_UNSUPPORTED_IN_VERSION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Variable unsupported in version: To include variables in your policy, use the policy version 2012-10-17 or later.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "To include variables in your policy, use the policy version 2012-10-17 or later."

오류 해결 To use policy variables, you must include the Version element and set it to a version that supports policy variables. Variables were introduced in version 2012-10-17. Earlier versions of the policy language don't support policy variables. If you don't set the Version to 2012-10-17 or later, variables like ${aws:username} are treated as literal strings in the policy. A Version policy element is different from a policy version. The Version policy element is used within a policy and defines the version of the policy language. A policy version, is created when you change a customer managed policy in IAM. The changed policy doesn't overwrite the existing policy. Instead, IAM creates a new version of the managed policy. 관련 용어

IAM policy elements: Variables

IAM JSON policy elements: Version

Error – Private IP address

Issue code: PRIVATE_IP_ADDRESS Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Private IP address: aws:SourceIp works only for public IP address ranges. The values for condition key aws:SourceIp include only private IP addresses and will not have the desired effect. Update the value to include only public IP addresses.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "aws:SourceIp works only for public IP address ranges. The values for condition key aws:SourceIp include only private IP addresses and will not have the desired effect. Update the value to include only public IP addresses."

오류 해결 The global condition key aws:SourceIp works only for public IP address ranges. You receive this error when your policy allows only private IP addresses. In this case, the condition would never match.

aws:SourceIp global condition key

IAM JSON policy elements: Condition

Error – Private NotIpAddress

Issue code: PRIVATE_NOT_IP_ADDRESS Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Private NotIpAddress: The values for condition key aws:SourceIp include only private IP addresses and has no effect. aws:SourceIp works only for public IP address ranges. Update the value to include only public IP addresses.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The values for condition key aws:SourceIp include only private IP addresses and has no effect. aws:SourceIp works only for public IP address ranges. Update the value to include only public IP addresses."

오류 해결 The global condition key aws:SourceIp works only for public IP address ranges. You receive this error when you use the NotIpAddress condition operator and list only private IP addresses. In this case, the condition would always match and would be ineffective.

aws:SourceIp global condition key

IAM JSON policy elements: Condition

Error – Policy size exceeds SCP quota

Issue code: POLICY_SIZE_EXCEEDS_SCP_QUOTA Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Policy size exceeds SCP quota: The {{policySize}} characters in the service control policy (SCP) exceed the {{policySizeQuota}} character maximum for SCPs. We recommend that you use multiple granular policies.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{policySize}} characters in the service control policy (SCP) exceed the {{policySizeQuota}} character maximum for SCPs. We recommend that you use multiple granular policies."

오류 해결 AWS Organizations service control policies (SCPs) support specifying values in the Action or NotAction elements. However, these values can include wildcards (*) only at the end of the string. This means that you can specify iam:Get* but not iam:*role. To specify multiple actions, AWS recommends that you list them individually. 관련 용어

Quotas for AWS Organizations

AWS Organizations service control policies

Error – Invalid service principal format

Issue code: INVALID_SERVICE_PRINCIPAL_FORMAT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid service principal format: The service principal does not match the expected format. Use the format {{expectedFormat}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The service principal does not match the expected format. Use the format {{expectedFormat}}."

오류 해결 The value in the condition key-value pair must match a defined service principal format. A service principal is an identifier that is used to grant permissions to a service. You can specify a service principal in the Principal element or as a value for some global condition keys and service-specific keys. The service principal is defined by each service. The identifier for a service principal includes the service name, and is usually in the following format in all lowercase letters: service-name.amazonaws.com Some service-specific keys may use a different format for service principals. For example, the kms:ViaService condition key requires the following format for service principals in all lowercase letters: service-name.AWS_region.amazonaws.com 관련 용어

Service principals

AWS global condition keys

kms:ViaService condition key

Error – Missing tag key in condition

Issue code: MISSING_TAG_KEY_IN_CONDITION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing tag key in condition: The condition key {{conditionKeyName}} must include a tag key to control access based on tags. Use the format {{conditionKeyName}}tag-key and specify a key name for tag-key.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{conditionKeyName}} must include a tag key to control access based on tags. Use the format {{conditionKeyName}}tag-key and specify a key name for tag-key."

오류 해결 To control access based on tags, you provide tag information in the condition element of a policy. For example, to control access to AWS resources, you include the aws:ResourceTag condition key. This key requires the format aws:ResourceTag/tag-key. To specify the tag key owner and the tag value JaneDoe in a condition, use the following format.

"Condition": {
    "StringEquals": {"aws:ResourceTag/owner": "JaneDoe"}
}

관련 용어

Controlling access using tags

Conditions

Global condition keys

AWS service condition keys

Error – Invalid vpc format

Issue code: INVALID_VPC_FORMAT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid vpc format: The VPC identifier in the condition key value is not valid. Use the prefix 'vpc-' followed by 8 or 17 alphanumeric characters.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The VPC identifier in the condition key value is not valid. Use the prefix 'vpc-' followed by 8 or 17 alphanumeric characters."

오류 해결 The aws:SourceVpc condition key must use the prefix vpc- followed by either 8 or 17 alphanumeric characters, for example, vpc-11223344556677889 or vpc-12345678. 관련 용어

AWS global condition keys: aws:SourceVpc

Error – Invalid vpce format

Issue code: INVALID_VPCE_FORMAT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid vpce format: The VPCE identifier in the condition key value is not valid.  Use the prefix 'vpce-' followed by 8 or 17 alphanumeric characters.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The VPCE identifier in the condition key value is not valid.  Use the prefix 'vpce-' followed by 8 or 17 alphanumeric characters."

오류 해결 The aws:SourceVpce condition key must use the prefix vpce- followed by either 8 or 17 alphanumeric characters, for example, vpce-11223344556677889 or vpce-12345678. 관련 용어

AWS global condition keys: aws:SourceVpce

Error – Federated principal not supported

Issue code: FEDERATED_PRINCIPAL_NOT_SUPPORTED Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Federated principal not supported: The policy type does not support a federated identity provider in the principal element. Use a supported principal.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy type does not support a federated identity provider in the principal element. Use a supported principal."

오류 해결 The Principal element uses federated principals for trust policies attached to IAM roles to provide access through identity federation. Identity policies and other resource-based policies don't support a federated identity provider in the Principal element. For example, you can't use a SAML principal in an Amazon S3 bucket policy. Change the Principal element to a supported principal type. 관련 용어

Creating a role for identity federation

JSON policy elements: Principal

Error – Unsupported action for condition key

Issue code: UNSUPPORTED_ACTION_FOR_CONDITION_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported action for condition key: The following actions: {{actions}} are not supported by the condition key {{key}}. The condition will not be evaluated for these actions. We recommend that you move these actions to a different statement without this condition key.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The following actions: {{actions}} are not supported by the condition key {{key}}. The condition will not be evaluated for these actions. We recommend that you move these actions to a different statement without this condition key."

오류 해결 Make sure that the condition key in the Condition element of the policy statement applies to every action in the Action element. To ensure that the actions you specify are effectively allowed or denied by your policy, you should move the unsupported actions to a different statement without the condition key.

Note

If the Action element has actions with wildcards, IAM Access Analyzer doesn't evaluate those actions for this error. 관련 용어

JSON policy elements: Action

Error – Unsupported action in policy

Issue code: UNSUPPORTED_ACTION_IN_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported action in policy: The action {{action}} is not supported for the resource-based policy attached to the resource type {{resourceType}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The action {{action}} is not supported for the resource-based policy attached to the resource type {{resourceType}}."

오류 해결 Some actions aren't supported in the Action element in the resource-based policy attached to a different resource type. For example, AWS Key Management Service actions aren't supported in Amazon S3 bucket policies. Specify an action that is supported by resource type attached to your resource-based policy. 관련 용어

JSON policy elements: Action

Error – Unsupported resource ARN in policy

Issue code: UNSUPPORTED_RESOURCE_ARN_IN_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported resource ARN in policy: The resource ARN is not supported for the resource-based policy attached to the resource type {{resourceType}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The resource ARN is not supported for the resource-based policy attached to the resource type {{resourceType}}."

오류 해결 Some resource ARNs aren't supported in the Resource element of the resource-based policy when the policy is attached to a different resource type. For example, AWS KMS ARNs aren't supported in the Resource element for Amazon S3 bucket policies. Specify a resource ARN that is supported by a resource type attached to your resource-based policy. 관련 용어

JSON policy elements: Action

Error – Unsupported condition key for service principal

Issue code: UNSUPPORTED_CONDITION_KEY_FOR_SERVICE_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unsupported condition key for service principal: The following condition keys are not supported when used with the service principal: {{conditionKeys}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The following condition keys are not supported when used with the service principal: {{conditionKeys}}."

오류 해결 You can specify AWS services in the Principal element of a resource-based policy using a service principal, which is an identifier for the service. You can't use some condition keys with certain service principals. For example, you can't use the aws:PrincipalOrgID condition key with the service principal cloudfront.amazonaws.com. You should remove condition keys that do not apply to the service principal in the Principal element. 관련 용어

Service principals

JSON policy elements: Principal

Error – Role trust policy syntax error notprincipal

Issue code: ROLE_TRUST_POLICY_SYNTAX_ERROR_NOTPRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Role trust policy syntax error notprincipal: Role trust policies do not support NotPrincipal. Update the policy to use a Principal element instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Role trust policies do not support NotPrincipal. Update the policy to use a Principal element instead."

오류 해결 A role trust policy is a resource-based policy that is attached to an IAM role. Trust policies define which principal entities (accounts, users, roles, and federated users) can assume the role. Role trust policies do not support NotPrincipal. Update the policy to use a Principal element instead. 관련 용어

JSON policy elements: Principal

JSON policy elements: NotPrincipal

Error – Role trust policy unsupported wildcard in principal

Issue code: ROLE_TRUST_POLICY_UNSUPPORTED_WILDCARD_IN_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Role trust policy unsupported wildcard in principal: "Principal:" "*" is not supported in the principal element of a role trust policy. Replace the wildcard with a valid principal value.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": ""Principal:" "*" is not supported in the principal element of a role trust policy. Replace the wildcard with a valid principal value."

오류 해결 A role trust policy is a resource-based policy that is attached to an IAM role. Trust policies define which principal entities (accounts, users, roles, and federated users) can assume the role. "Principal:" "*" is not supported in the Principal element of a role trust policy. Replace the wildcard with a valid principal value. 관련 용어

JSON policy elements: Principal

Error – Role trust policy syntax error resource

Issue code: ROLE_TRUST_POLICY_SYNTAX_ERROR_RESOURCE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Role trust policy syntax error resource: Role trust policies apply to the role that they are attached to. You cannot specify a resource. Remove the Resource or NotResource element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Role trust policies apply to the role that they are attached to. You cannot specify a resource. Remove the Resource or NotResource element."

오류 해결 A role trust policy is a resource-based policy that is attached to an IAM role. Trust policies define which principal entities (accounts, users, roles, and federated users) can assume the role. Role trust policies apply to the role that they are attached to. You cannot specify a Resource or NotResource element in a role trust policy. Remove the Resource or NotResource element.

JSON policy elements: Resource

JSON policy elements: NotResource

Error – Type mismatch IP range

Issue code: TYPE_MISMATCH_IP_RANGE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Type mismatch IP range: The condition operator {{operator}} is used with an invalid IP range value. Specify the IP range in standard CIDR format.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition operator {{operator}} is used with an invalid IP range value. Specify the IP range in standard CIDR format."

오류 해결 Update the text to use the IP address condition operator data type, in a CIDR format. 관련 용어

IP address condition operators

IAM JSON policy elements: Condition operators

Error – Missing action for condition key

Issue code: MISSING_ACTION_FOR_CONDITION_KEY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing action for condition key: The {{actionName}} action must be in the action block to allow setting values for the condition key {{keyName}}. Add {{actionName}} to the action block.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{actionName}} action must be in the action block to allow setting values for the condition key {{keyName}}. Add {{actionName}} to the action block."

오류 해결 The condition key in the Condition element of the policy statement is not evaluated unless the specified action is in the Action element. To ensure that the condition keys you specify are effectively allowed or denied by your policy, add the action to the Action element. 관련 용어

JSON policy elements: Action

Error – Invalid federated principal syntax in role trust policy

Issue code: INVALID_FEDERATED_PRINCIPAL_SYNTAX_IN_ROLE_TRUST_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid federated principal syntax in role trust policy: The principal value specifies a federated principal that does not match the expected format. Update the federated principal to a domain name or a SAML metadata ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The principal value specifies a federated principal that does not match the expected format. Update the federated principal to a domain name or a SAML metadata ARN."

오류 해결 The principal value specifies a federated principal that does not match the expected format. Update the format of the federated principal to a valid domain name or a SAML metadata ARN. 관련 용어

Federated users and roles

Error – Mismatched action for principal

Issue code: MISMATCHED_ACTION_FOR_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Mismatched action for principal: The {{actionName}} action is invalid with the following principal(s): {{principalNames}}. Use a SAML provider principal with the sts:AssumeRoleWithSAML action or use an OIDC provider principal with the sts:AssumeRoleWithWebIdentity action. Ensure the provider is Federated if you use either of the two options.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{actionName}} action is invalid with the following principal(s): {{principalNames}}. Use a SAML provider principal with the sts:AssumeRoleWithSAML action or use an OIDC provider principal with the sts:AssumeRoleWithWebIdentity action. Ensure the provider is Federated if you use either of the two options."

오류 해결 The action specified in the Action element of the policy statement is invalid with the principal specified in the Principal element. For example, you can't use a SAML provider principal with the sts:AssumeRoleWithWebIdentity action. You should use a SAML provider principal with the sts:AssumeRoleWithSAML action or use an OIDC provider principal with the sts:AssumeRoleWithWebIdentity action. 관련 용어

AssumeRoleWithSAML

AssumeRoleWithWebIdentity

Error – Missing action for roles anywhere trust policy

Issue code: MISSING_ACTION_FOR_ROLES_ANYWHERE_TRUST_POLICY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing action for roles anywhere trust policy: The rolesanywhere.amazonaws.com service principal requires the sts:AssumeRole, sts:SetSourceIdentity, and sts:TagSession permissions to assume a role. Add the missing permissions to the policy.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The rolesanywhere.amazonaws.com service principal requires the sts:AssumeRole, sts:SetSourceIdentity, and sts:TagSession permissions to assume a role. Add the missing permissions to the policy."

오류 해결 For IAM Roles Anywhere to be able to assume a role and deliver temporary AWS credentials, the role must trust the IAM Roles Anywhere service principal. The IAM Roles Anywhere service principal requires the sts:AssumeRole, sts:SetSourceIdentity, and sts:TagSession permissions to assume a role. If any of the permissions are missing, you must add them to your policy. 관련 용어

Trust model in AWS Identity and Access Management Roles Anywhere

Error – Policy size exceeds RCP quota

Issue code: POLICY_SIZE_EXCEEDS_RCP_QUOTA Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Policy size exceeds RCP quota: The {{policySize}} characters in the resource control policy (RCP) exceed the {{policySizeQuota}} character maximum for RCPs. We recommend that you use multiple granular policies.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{policySize}} characters in the resource control policy (RCP) exceed the {{policySizeQuota}} character maximum for RCPs. We recommend that you use multiple granular policies."

오류 해결 AWS Organizations resource control policies (RCPs) support specifying values in the Action element. However, these values can include wildcards (*) only at the end of the string. This means that you can specify s3:Get* but not s3:*Object. To specify multiple actions, AWS recommends that you list them individually. 관련 용어

Quotas for AWS Organizations

AWS Organizations resource control policies

Error – RCP syntax error principal

Issue code: RCP_SYNTAX_ERROR_PRINCIPAL Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP syntax error principal: The Principal element contents are not valid. RCPs only support specifying all principals ("*") in the Principal element. The NotPrincipal element is not supported for RCPs.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Principal element contents are not valid. RCPs only support specifying all principals ("*") in the Principal element. The NotPrincipal element is not supported for RCPs."

오류 해결 AWS Organizations resource control policies (RCPs) only support specifying all principals ("*") in the Principal element. The NotPrincipal element is not supported for RCPs. 관련 용어

RCP syntax

Properties of the principal

Error – RCP syntax error allow

Issue code: RCP_SYNTAX_ERROR_ALLOW Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP syntax error allow: RCPs only support specifying all principals ("*") in the Principal element, all resources ("*") in the Resource element, and no Condition element with an effect of Allow.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "RCPs only support specifying all principals ("*") in the Principal element, all resources ("*") in the Resource element, and no Condition element with an effect of Allow."

오류 해결 AWS Organizations resource control policies (RCPs) only support specifying all principals ("*") in the Principal element and all resources ("*") in the Resource element. The Condition element with an effect of Allow is not supported for RCPs. 관련 용어

RCP syntax

Properties of the principal

Properties of the resource

Error – RCP syntax error NotAction

Issue code: RCP_SYNTAX_ERROR_NOTACTION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP syntax error NotAction: RCPs do not support the NotAction element. Update to use the Action element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "RCPs do not support the NotAction element. Update to use the Action element."

오류 해결 AWS Organizations resource control policies (RCPs) do not support the NotAction element. Use the Action element. 관련 용어

RCP syntax

IAM JSON policy elements: Action

IAM JSON policy elements: NotAction

Error – RCP syntax error action

Issue code: RCP_SYNTAX_ERROR_ACTION Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP syntax error action: RCPs only support specifying select service prefixes in the Action element. Learn more here.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "RCPs only support specifying select service prefixes in the Action element. Learn more here."

오류 해결 AWS Organizations resource control policies (RCPs) only support specifying select service prefixes in the Action element. 관련 용어

RCP syntax

List of AWS services that support RCPs

Error – Missing ARN account

Issue code: MISSING_ARN_ACCOUNT Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing ARN account: The resource {{resourceName}} in the arn is missing an account id. Please provide a 12 digit account id.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The resource {{resourceName}} in the arn is missing an account id. Please provide a 12 digit account id."

오류 해결 Include an account ID in the resource ARN. Account IDs are 12-digit integers. To learn how to view your account ID, see Finding your AWS account ID. 관련 용어

Policy resources

Account Identifiers

Resource ARNs

AWS service resources with ARN formats

Error – Invalid kms key value

Issue code: INVALID_KMS_KEY_VALUE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid kms key value: The {{key}} condition key value must be a valid KMS key ARN.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{key}} condition key value must be a valid KMS key ARN."

오류 해결 An AWS KMS key ARN (Amazon Resource Name) is a unique, fully qualified identifier for a KMS key. A key ARN includes the AWS account, Region, and the key ID. A key ARN follows this format: arn:aws:kms:region:account-id:key/key-id 관련 용어

Find the key ID and key ARN

Key ARN

AWS global condition context keys

Error – Variable usage too permissive

Issue code: VARIABLE_USAGE_TOO_PERMISSIVE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Variable usage too permissive: Overly permissive use of policy variable for the {{key}} condition key. Use the policy variable preceded by 6 consecutive characters.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

The policy variable is not allowed in the condition key {{key}}. We consider the key to be sensitive and policy variables can be evaluated as effective wildcards. Therefore policy variables are not allowed to be used with sensitive keys. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html for the list of sensitive keys.

오류 해결 There are three possible finding messages for this error.

For the first error message, modify your policy variable usage to be more specific. Add at least 6 consecutive characters before the policy variable to reduce the scope of permissions. For example, instead of using ${aws:username}, use prefix-${aws:username} or myapp-${aws:username}. This ensures that the policy variable doesn't grant overly broad access.

For the second error message, remove the policy variable from the specified condition key. Policy variables can act as effective wildcards and are not permitted with sensitive condition keys for security reasons. Instead, use specific static values or consider restructuring your policy to use non-sensitive condition keys that support policy variables.

For the third error message, modify your aws:userID policy variable usage to be more restrictive. Place the policy variable on the right side of a colon (after the account ID) or use it as the only character on the left side of a colon. For example, use AIDACKCEVSQ6C2EXAMPLE:${aws:userid} or ${aws:userid}:* instead of ${aws:userid}. 관련 용어

IAM policy elements: Variables and tags

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

Error – Wildcard usage too permissive

Issue code: WILDCARD_USAGE_TOO_PERMISSIVE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Overly permissive use of policy variable with aws:userID. Use the policy variable on the right side of colon or as the only character on the left side of a colon.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Overly permissive use of policy variable for the {{key}} condition key. Use the policy variable preceded by 6 consecutive characters."

오류 해결 There are three possible finding messages for this error.

For the first error message, make your wildcard usage more specific by adding at least 6 consecutive characters before the wildcard. For example, instead of using *, use prefix-* or prefix-*-suffix. This reduces the scope of the condition and follows the principle of least privilege.

For the second error message, remove the wildcard from the specified condition key. Wildcards are not permitted with sensitive condition keys for security reasons. Replace the wildcard with specific values that match your intended access pattern, or consider using a different, non-sensitive condition key that supports wildcards.

For the third error message, modify your aws:userID wildcard usage to be more restrictive. Place the wildcard on the right side of a colon (after the account ID) or use it as the only character on the left side of a colon. For example, use AIDACKCEVSQ6C2EXAMPLE:* or *:* instead of *. 관련 용어

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

IAM identifiers

Error – DynamoDB invalid return consumed capacity

Issue code: DYNAMODB_INVALID_RETURN_CONSUMED_CAPACITY Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The policy variable is not allowed in the condition key {{key}}. We consider the key to be sensitive and policy variables can be evaluated as effective wildcards. Therefore policy variables are not allowed to be used with sensitive keys. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html for the list of sensitive keys."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Overly permissive use of policy variable with aws:userID. Use the policy variable on the right side of colon or as the only character on the left side of a colon."

오류 해결 Update the condition value to one of the two values DynamoDB provides: TOTAL or NONE. Values are case-sensitive under StringEquals and StringLike, so a lowercase variant such as total is not valid. The StringEqualsIgnoreCase operator accepts any casing. A condition that specifies an invalid value never matches any request, so the statement has no effect.

Error – DynamoDB invalid return values

Issue code: DYNAMODB_INVALID_RETURN_VALUES Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Wildcard usage too permissive: Overly permissive use of wildcard for the {{key}} condition key. Use the wildcard preceded by 6 consecutive characters.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

The wildcard is not allowed in the condition key {{key}}. We consider the key to be sensitive and wildcards are not allowed to be used with sensitive keys. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html for the list of sensitive keys.

오류 해결 Update the condition value to one of the five values DynamoDB provides: NONE, ALL_OLD, UPDATED_OLD, ALL_NEW, or UPDATED_NEW. Values are case-sensitive under StringEquals and StringLike, so a lowercase variant such as updated_new is not valid. The StringEqualsIgnoreCase operator accepts any casing. A condition that specifies an invalid value never matches any request, so the statement has no effect.

Error – DynamoDB invalid select value

Issue code: DYNAMODB_INVALID_SELECT_VALUE Finding type: ERROR 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Overly permissive use of wildcard with aws:userID. Use the wildcard on the right side of colon or as the only character on the left side of a colon.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Overly permissive use of wildcard for the {{key}} condition key. Use the wildcard preceded by 6 consecutive characters."

오류 해결 Update the condition value to one of the four values DynamoDB provides: ALL_ATTRIBUTES, ALL_PROJECTED_ATTRIBUTES, SPECIFIC_ATTRIBUTES, or COUNT. Values are case-sensitive under StringEquals and StringLike, so a lowercase variant such as specific_attributes is not valid. The StringEqualsIgnoreCase operator accepts any casing. A condition that specifies an invalid value never matches any request, so the statement has no effect.

General Warning – Create SLR with NotResource

Issue code: CREATE_SLR_WITH_NOT_RESOURCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The wildcard is not allowed in the condition key {{key}}. We consider the key to be sensitive and wildcards are not allowed to be used with sensitive keys. Refer to https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html for the list of sensitive keys."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Overly permissive use of wildcard with aws:userID. Use the wildcard on the right side of colon or as the only character on the left side of a colon."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Using iam:CreateServiceLinkedRole in a policy with the NotResource element can allow creating unintended service-linked roles for multiple resources. AWS recommends that you specify allowed ARNs in the Resource element instead.

CreateServiceLinkedRole operation

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

General Warning – Create SLR with star in action and NotResource

Issue code: CREATE_SLR_WITH_STAR_IN_ACTION_AND_NOT_RESOURCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB invalid return consumed capacity: The value for dynamodb:ReturnConsumedCapacity is not valid. Update {{value}} to either TOTAL or NONE.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The value for dynamodb:ReturnConsumedCapacity is not valid. Update {{value}} to either TOTAL or NONE."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Policies with a wildcard (*) in the Action and that include the NotResource element can allow creation of unintended service-linked roles for multiple resources. AWS recommends that you specify allowed ARNs in the Resource element instead.

CreateServiceLinkedRole operation

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

General Warning – Create SLR with NotAction and NotResource

Issue code: CREATE_SLR_WITH_NOT_ACTION_AND_NOT_RESOURCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB invalid return values: The value for dynamodb:ReturnValues is not valid. Update {{value}} to one of NONE, ALL_OLD, UPDATED_OLD, ALL_NEW, or UPDATED_NEW.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The value for dynamodb:ReturnValues is not valid. Update {{value}} to one of NONE, ALL_OLD, UPDATED_OLD, ALL_NEW, or UPDATED_NEW."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Using the NotAction element with the NotResource element can allow creating unintended service-linked roles for multiple resources. AWS recommends that you rewrite the policy to allow iam:CreateServiceLinkedRole on a limited list of ARNs in the Resource element instead. You can also add iam:CreateServiceLinkedRole to the NotAction element.

CreateServiceLinkedRole operation

IAM JSON policy elements: NotAction

IAM JSON policy elements: Action

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

General Warning – Create SLR with star in resource

Issue code: CREATE_SLR_WITH_STAR_IN_RESOURCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB invalid select value: The value for dynamodb:Select is not valid. Update {{value}} to one of ALL_ATTRIBUTES, ALL_PROJECTED_ATTRIBUTES, SPECIFIC_ATTRIBUTES, or COUNT.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The value for dynamodb:Select is not valid. Update {{value}} to one of ALL_ATTRIBUTES, ALL_PROJECTED_ATTRIBUTES, SPECIFIC_ATTRIBUTES, or COUNT."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Using iam:CreateServiceLinkedRole in a policy with a wildcard (*) in the Resource element can allow creating unintended service-linked roles for multiple resources. AWS recommends that you specify allowed ARNs in the Resource element instead.

CreateServiceLinkedRole operation

IAM JSON policy elements: Resource

AWS managed policies with this general warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. Some of those use cases are for power users within your account. The following AWS managed policies provide power user access and grant permissions to create service-linked roles for any AWS service. AWS recommends that you attach the following AWS managed policies to only IAM identities that you consider power users.

PowerUserAccess

AlexaForBusinessFullAccess

AWSOrganizationsServiceTrustPolicy – This AWS managed policy provides permissions for use by the AWS Organizations service-linked role. This role allows Organizations to create additional service-linked roles for other services in your AWS organization.

General Warning – Create SLR with star in action and resource

Issue code: CREATE_SLR_WITH_STAR_IN_ACTION_AND_RESOURCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with NotResource: Using the iam:CreateServiceLinkedRole action with NotResource can allow creation of unintended service-linked roles for multiple resources. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the iam:CreateServiceLinkedRole action with NotResource can allow creation of unintended service-linked roles for multiple resources. We recommend that you specify resource ARNs instead."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Policies with a wildcard (*) in the Action and Resource elements can allow creating unintended service-linked roles for multiple resources. This allows creating a service-linked role when you specify "Action": "*", "Action": "iam:*", or "Action": "iam:Create*". AWS recommends that you specify allowed ARNs in the Resource element instead.

CreateServiceLinkedRole operation

IAM JSON policy elements: Action

IAM JSON policy elements: Resource

AWS managed policies with this general warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. Some of those use cases are for administrators within your account. The following AWS managed policies provide administrator access and grant permissions to create service-linked roles for any AWS service. AWS recommends that you attach the following AWS managed policies to only the IAM identities that you consider administrators.

AdministratorAccess

IAMFullAccess

General Warning – Create SLR with star in resource and NotAction

Issue code: CREATE_SLR_WITH_STAR_IN_RESOURCE_AND_NOT_ACTION Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with star in action and NotResource: Using an action with a wildcard(*) and NotResource can allow creation of unintended service-linked roles because it can allow iam:CreateServiceLinkedRole permissions on multiple resources. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using an action with a wildcard(*) and NotResource can allow creation of unintended service-linked roles because it can allow iam:CreateServiceLinkedRole permissions on multiple resources. We recommend that you specify resource ARNs instead."

Resolving the general warning The action iam:CreateServiceLinkedRole grants permission to create an IAM role that allows an AWS service to perform actions on your behalf. Using the NotAction element in a policy with a wildcard (*) in the Resource element can allow creating unintended service-linked roles for multiple resources. AWS recommends that you specify allowed ARNs in the Resource element instead. You can also add iam:CreateServiceLinkedRole to the NotAction element.

CreateServiceLinkedRole operation

IAM JSON policy elements: NotAction

IAM JSON policy elements: Action

IAM JSON policy elements: Resource

General Warning – Deprecated global condition key

Issue code: DEPRECATED_GLOBAL_CONDITION_KEY Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with NotAction and NotResource: Using NotAction with NotResource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on multiple resources. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using NotAction with NotResource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on multiple resources. We recommend that you specify resource ARNs instead."

Resolving the general warning The policy includes a deprecated global condition key. Update the condition key in the condition key-value pair to use a supported global condition key.

Global condition keys

General Warning – Invalid date value

Issue code: INVALID_DATE_VALUE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with star in resource: Using the iam:CreateServiceLinkedRole action with wildcards (*) in the resource can allow creation of unintended service-linked roles. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the iam:CreateServiceLinkedRole action with wildcards (*) in the resource can allow creation of unintended service-linked roles. We recommend that you specify resource ARNs instead."

Resolving the general warning Unix Epoch time describes a point in time that has elapsed since January 1, 1970, minus leap seconds. Epoch time might not resolve to the precise time that you expect. AWS recommends that you use the W3C standard for date and time formats. For example, you could specify a complete date, such as YYYY-MM-DD (1997-07-16), or you could also append the time to the second, such as YYYY-MM-DDThh:mm:ssTZD (1997-07-16T19:20:30+01:00).

W3C Date and Time Formats

IAM JSON policy elements: Version

aws:CurrentTime global condition key

General Warning – Invalid role reference

Issue code: INVALID_ROLE_REFERENCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with star in action and resource: Using wildcards (*) in the action and the resource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using wildcards (*) in the action and the resource can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead."

Resolving the general warning AWS recommends that you specify the Amazon Resource Name (ARN) for an IAM role instead of its principal ID. When IAM saves the policy, it will transform the ARN into the principal ID for the existing role. AWS includes a safety precaution. If someone deletes and recreates the role, it will have a new ID, and the policy won't match the new role's ID.

Specifying a principal: IAM roles

IAM ARNs

IAM unique IDs

General Warning – Invalid user reference

Issue code: INVALID_USER_REFERENCE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Create SLR with star in resource and NotAction: Using a resource with wildcards (*) and NotAction can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using a resource with wildcards (*) and NotAction can allow creation of unintended service-linked roles because it allows iam:CreateServiceLinkedRole permissions on all resources. We recommend that you specify resource ARNs instead."

Resolving the general warning AWS recommends that you specify the Amazon Resource Name (ARN) for an IAM user instead of its principal ID. When IAM saves the policy, it will transform the ARN into the principal ID for the existing user. AWS includes a safety precaution. If someone deletes and recreates the user, it will have a new ID, and the policy won't match the new user's ID.

Specifying a principal: IAM users

IAM ARNs

IAM unique IDs

General Warning – Missing version

Issue code: MISSING_VERSION Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Deprecated global condition key: We recommend that you update aws:ARN to use the newer condition key aws:PrincipalArn.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "We recommend that you update aws:ARN to use the newer condition key aws:PrincipalArn."

Resolving the general warning AWS recommends that you include the optional Version parameter in your policy. If you do not include a Version element, the value defaults to 2012-10-17, but newer features, such as policy variables, will not work with your policy. For example, variables such as ${aws:username} aren't recognized as variables and are instead treated as literal strings in the policy.

IAM JSON policy elements: Version

General Warning – Unique Sids recommended

Issue code: UNIQUE_SIDS_RECOMMENDED Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid date value: The date {{date}} might not resolve as expected. We recommend that you use the YYYY-MM-DD format.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The date {{date}} might not resolve as expected. We recommend that you use the YYYY-MM-DD format."

Resolving the general warning AWS recommends that you use unique statement IDs. The Sid (statement ID) element allows you to enter an optional identifier that you provide for the policy statement. You can assign a statement ID value to each statement in a statement array using the SID element. 관련 용어

IAM JSON policy elements: Sid

General Warning – Wildcard without like operator

Issue code: WILDCARD_WITHOUT_LIKE_OPERATOR Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Invalid role reference: The Principal element includes the IAM role ID {{roleid}}. We recommend that you use a role ARN instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Principal element includes the IAM role ID {{roleid}}. We recommend that you use a role ARN instead."

Resolving the general warning The Condition element structure requires that you use a condition operator and a key-value pair. When you specify a condition value that uses a wildcard (*, ?), you must use the Like version of the condition operator. For example, instead of the StringEquals string condition operator, use StringLike.

Invalid user reference: The Principal element includes the IAM user ID {{userid}}. We recommend that you use a user ARN instead.

IAM JSON policy elements: Condition operators

IAM JSON policy elements: Condition

AWS managed policies with this general warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. The following AWS managed policies include wildcards in their condition value without a condition operator that includes Like for pattern-matching. When using the AWS managed policy as a reference to create your customer managed policy, AWS recommends that you use a condition operator that supports pattern-matching with wildcards (*, ?), such as StringLike.

AWSGlueConsoleSageMakerNotebookFullAccess

General Warning – Policy size exceeds identity policy quota

Issue code: POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The Principal element includes the IAM user ID {{userid}}. We recommend that you use a user ARN instead."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing version: We recommend that you specify the Version element to help you with debugging permission issues.

Resolving the general warning You can attach up to 20 managed policies to an IAM identity (user, group of users, or role). However, the size of each managed policy cannot exceed the default quota of 6,144 characters. IAM does not count white space when calculating the size of a policy against this quota. Quotas, also referred to as limits in AWS, are the maximum values for the resources, actions, and items in your AWS account. Additionally, you can add as many inline policies as you want to an IAM identity. However, the sum size of all inline policies per identity cannot exceed the specified quota. If your policy is larger than the quota, you can organize your policy into multiple statements and group the statements into multiple policies. 관련 용어

IAM and AWS STS character quotas

Multiple statements and multiple policies

IAM customer managed policies

Overview of JSON policies

IAM JSON policy grammar

AWS managed policies with this general warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. The following AWS managed policies grant permissions to actions across many AWS services and exceed the maximum policy size. When using the AWS managed policy as a reference to create your managed policy, you must split the policy into multiple policies.

ReadOnlyAccess

AWSSupportServiceRolePolicy

General Warning – Policy size exceeds resource policy quota

Issue code: POLICY_SIZE_EXCEEDS_RESOURCE_POLICY_QUOTA Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "We recommend that you specify the Version element to help you with debugging permission issues."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Unique Sids recommended: We recommend that you use statement IDs that are unique to your policy. Update the Sid value.

Resolving the general warning Resource-based policies are JSON policy documents that you attach to a resource, such as an Amazon S3 bucket. These policies grant the specified principal permission to perform specific actions on that resource and define under what conditions this applies. The size of resource-based policies cannot exceed the quota set for that resource. Quotas, also referred to as limits in AWS, are the maximum values for the resources, actions, and items in your AWS account. If your policy is larger than the quota, you can organize your policy into multiple statements and group the statements into multiple policies. 관련 용어

Resource-based policies

Amazon S3 bucket policies

Multiple statements and multiple policies

Overview of JSON policies

IAM JSON policy grammar

General Warning – Type mismatch

Issue code: TYPE_MISMATCH Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "We recommend that you use statement IDs that are unique to your policy. Update the Sid value."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Wildcard without like operator: Your condition value includes a * or ? character. If you meant to use a wildcard (*, ?), update the condition operator to include Like.

Resolving the general warning Update the text to use the supported condition operator data type. For example, the aws:MultiFactorAuthPresent global condition key requires a condition operator with the Boolean data type. If you provide a date or an integer, the data type won't match. 관련 용어

Global condition keys

IAM JSON policy elements: Condition operators

General Warning – Type mismatch Boolean

Issue code: TYPE_MISMATCH_BOOLEAN Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Your condition value includes a * or ? character. If you meant to use a wildcard (*, ?), update the condition operator to include Like."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"Condition": {"StringLike": {"aws:PrincipalTag/job-category": "admin-*"}}

Resolving the general warning Update the text to use a Boolean condition operator data type, such as true or false. For example, the aws:MultiFactorAuthPresent global condition key requires a condition operator with the Boolean data type. If you provide a date or an integer, the data type won't match. 관련 용어

Boolean condition operators

IAM JSON policy elements: Condition operators

General Warning – Type mismatch date

Issue code: TYPE_MISMATCH_DATE Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Policy size exceeds identity policy quota: The {{policySize}} characters in the identity policy, excluding whitespace, exceed the {{policySizeQuota}} character maximum for inline and managed policies. We recommend that you use multiple granular policies.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{policySize}} characters in the identity policy, excluding whitespace, exceed the {{policySizeQuota}} character maximum for inline and managed policies. We recommend that you use multiple granular policies."

Resolving the general warning Update the text to use the date condition operator data type, in a YYYY-MM-DD or other ISO 8601 date time format. 관련 용어

Date condition operators

IAM JSON policy elements: Condition operators

General Warning – Type mismatch number

Issue code: TYPE_MISMATCH_NUMBER Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Policy size exceeds resource policy quota: The {{policySize}} characters in the resource policy exceed the {{policySizeQuota}} character maximum for resource policies. We recommend that you use multiple granular policies.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{policySize}} characters in the resource policy exceed the {{policySizeQuota}} character maximum for resource policies. We recommend that you use multiple granular policies."

Resolving the general warning Update the text to use the numeric condition operator data type. 관련 용어

Numeric condition operators

IAM JSON policy elements: Condition operators

General Warning – Type mismatch string

Issue code: TYPE_MISMATCH_STRING Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Type mismatch: Use the operator type {{allowed}} instead of operator {{operator}} for the condition key {{key}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Use the operator type {{allowed}} instead of operator {{operator}} for the condition key {{key}}."

Resolving the general warning Update the text to use the string condition operator data type. 관련 용어

String condition operators

IAM JSON policy elements: Condition operators

General Warning – Specific github repo and branch recommended

Issue code: SPECIFIC_GITHUB_REPO_AND_BRANCH_RECOMMENDED Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Type mismatch Boolean: Add a valid Boolean value (true or false) for the condition operator {{operator}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a valid Boolean value (true or false) for the condition operator {{operator}}."

Resolving the general warning If you use GitHub as an OIDC IdP, best practice is to limit the entities that can assume the role associated with the IAM IdP. When you include a Condition statement in a role trust policy, you can limit the role to a specific GitHub organization, repository, or branch. You can use the condition key token.actions.githubusercontent.com:sub to limit access. We recommend that you limit the condition to a specific set of repositories or branches. If you use a wildcard (*) in token.actions.githubusercontent.com:sub, then GitHub Actions from organizations or repositories outside of your control are able to assume roles associated with the GitHub IAM IdP in your AWS account. Specify the repository in token.actions.githubusercontent.com:sub. You can specify the branch in that same value, or in a separate token.actions.githubusercontent.com:ref condition key. When the subject claim does not include the branch — for example, when it names a GitHub environment — specify the branch in token.actions.githubusercontent.com:ref. 관련 용어

Configuring a role for GitHub OIDC identity provider

General Warning – Policy size exceeds role trust policy quota

Issue code: POLICY_SIZE_EXCEEDS_ROLE_TRUST_POLICY_QUOTA Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Type mismatch date: The date condition operator is used with an invalid value. Specify a valid date using YYYY-MM-DD or other ISO 8601 date/time format.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The date condition operator is used with an invalid value. Specify a valid date using YYYY-MM-DD or other ISO 8601 date/time format."

Resolving the general warning IAM and AWS STS have quotas that limit the size of role trust policies. The characters in the role trust policy, excluding whitespace, exceed the character maximum. We recommend that you request a role trust policy length quota increase using Service Quotas and the AWS Support Center Console. 관련 용어

IAM and AWS STS quotas, name requirements, and character limits

General Warning – RCP missing related principal condition key

Issue code: RCP_MISSING_RELATED_PRINCIPAL_CONDITION_KEY Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Type mismatch number: Add a valid numeric value for the condition operator {{operator}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a valid numeric value for the condition operator {{operator}}."

Resolving the general warning AWS Organizations resource control policies (RCPs) can impact IAM roles, users, and AWS service principals. To prevent unintended impact to services acting on your behalf using a service principal, add the following statement to your Condition element:

Type mismatch string: Add a valid base64-encoded string value for the condition operator {{operator}}.

관련 용어

RCP syntax

Properties of the principal

General Warning – RCP missing related service principal condition key

Issue code: RCP_MISSING_RELATED_SERVICE_PRINCIPAL_CONDITION_KEY Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a valid base64-encoded string value for the condition operator {{operator}}."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Specific github repo and branch recommended: Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name. If the subject claim does not include the branch, specify it in a token.actions.githubusercontent.com:ref condition key.

Resolving the general warning AWS Organizations resource control policies (RCPs) can impact IAM roles, users, and AWS service principals. To prevent unintended impact to your principals, add the following statement to your Condition element:

"findingDetails": "Using a wildcard (*) in token.actions.githubusercontent.com:sub can allow requests from more sources than you intended. Specify the value of token.actions.githubusercontent.com:sub with the repository and branch name. If the subject claim does not include the branch, specify it in a token.actions.githubusercontent.com:ref condition key."

관련 용어

RCP syntax

Properties of the principal

General Warning – RCP missing service condition key null check

Issue code: RCP_MISSING_SERVICE_CONDITION_KEY_NULL_CHECK Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Policy size exceeds role trust policy quota: The characters in the role trust policy, excluding whitespace, exceed the character maximum. We recommend that you request a role trust policy length quota increase using Service Quotas and AWS Support Center. If the quotas have already been increased, then you can ignore this warning.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The characters in the role trust policy, excluding whitespace, exceed the character maximum. We recommend that you request a role trust policy length quota increase using Service Quotas and AWS Support Center. If the quotas have already been increased, then you can ignore this warning."

Resolving the general warning AWS Organizations resource control policies (RCPs) can impact IAM roles, users, and AWS service principals. To prevent unintended impact to services acting on your behalf using a service principal, add one of the following statements to your Condition element whenever the specified key is used:

RCP missing related principal condition key: RCPs impact IAM roles, users, and AWS service principals. To prevent unintended impact to services acting on your behalf using a service principal, an additional statement should be added to the Condition block "BoolIfExists": { "aws:PrincipalIsAWSService": "false"} whenever a principal key {{conditionKeyName}} is used.

or

"findingDetails": "RCPs impact IAM roles, users, and AWS service principals. To prevent unintended impact to services acting on your behalf using a service principal, an additional statement should be added to the Condition block "BoolIfExists": { "aws:PrincipalIsAWSService": "false"} whenever a principal key {{conditionKeyName}} is used."

관련 용어

RCP syntax

Properties of the principal

General Warning – Use condition key only with supported services

Issue code: USE_CONDITION_KEY_ONLY_WITH_SUPPORTED_SERVICES Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"BoolIfExists": { "aws:PrincipalIsAWSService": "false"}

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP missing related service principal condition key: RCPs impact IAM roles, users, and AWS service principals. To prevent unintended impact to your principals, an additional statement should be added to the Condition block "BoolIfExists": { "aws:PrincipalIsAWSService": "true"} whenever the key {{conditionKeyName}} is used.

Resolving the general warning Review the AWS documentation to identify which AWS services support this condition key. If any services in your policy don't support the condition key, modify your policy to scope the condition key to only the AWS services that support it. 관련 용어

aws:VpceAccount

aws:VpceOrgID

aws:VpceOrgPaths

Actions, resources, and condition keys for AWS services

General Warning – DynamoDB replace operation with attributes

Issue code: DYNAMODB_REPLACE_OPERATION_WITH_ATTRIBUTES Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "RCPs impact IAM roles, users, and AWS service principals. To prevent unintended impact to your principals, an additional statement should be added to the Condition block "BoolIfExists": { "aws:PrincipalIsAWSService": "true"} whenever the key {{conditionKeyName}} is used."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"BoolIfExists": { "aws:PrincipalIsAWSService": "true"}

Resolving the general warning The dynamodb:Attributes condition does not limit dynamodb:PutItem or dynamodb:BatchWriteItem. These actions replace the whole item, so a caller can drop a restricted attribute just by leaving it out of the item they write. To control which attributes a caller can change, grant dynamodb:UpdateItem instead and keep the dynamodb:Attributes condition on that statement. If you did not intend attribute-level control here, remove the dynamodb:Attributes condition.

General Warning – DynamoDB scan bypasses leading keys

Issue code: DYNAMODB_SCAN_BYPASSES_LEADING_KEYS Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

RCP missing service condition key null check: The specified service may have a service integration that does not require the use of the {{conditionKeyName}} condition key. To prevent unintended impact to services acting on your behalf using a service principal, an additional statement should be added to the Condition block "Null": { "aws:SourceAccount": "false"} or "Null": { "aws:SourceArn": "false"} whenever the key {{conditionKeyName}} is used.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The specified service may have a service integration that does not require the use of the {{conditionKeyName}} condition key. To prevent unintended impact to services acting on your behalf using a service principal, an additional statement should be added to the Condition block "Null": { "aws:SourceAccount": "false"} or "Null": { "aws:SourceArn": "false"} whenever the key {{conditionKeyName}} is used."

Resolving the general warning dynamodb:Scan reads the entire table, so the dynamodb:LeadingKeys condition in this statement does not limit which items a caller can read. Remove dynamodb:Scan, or grant it in a separate statement that does not rely on dynamodb:LeadingKeys.

General Warning – DynamoDB wrong condition for action

Issue code: DYNAMODB_WRONG_CONDITION_FOR_ACTION Finding type: GENERAL_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"Null": { "aws:SourceAccount": "false"}

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"Null": { "aws:SourceArn": "false"}

Resolving the general warning This statement uses dynamodb:Select with a write action, or dynamodb:ReturnValues with a read action. DynamoDB provides dynamodb:Select only for read actions and dynamodb:ReturnValues only for write actions, so the condition here never takes effect and protects nothing. Pair each key with a supporting action, or remove it. This check applies to both Allow and Deny statements.

Security Warning – Untrustworthy condition key

Issue code: UNTRUSTWORTHY_CONDITION_KEY Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Use condition key only with supported services: The condition key {{key}} works only with specific AWS services and must be scoped to supported services in your policies.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{key}} works only with specific AWS services and must be scoped to supported services in your policies.

Resolving the security warning Do not use this condition key for access control. The caller can potentially manipulate or spoof the key value, which creates a security risk. 관련 용어

AWS global condition context keys

Security Warning – Allow with NotPrincipal

Issue code: ALLOW_WITH_NOT_PRINCIPAL Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB replace operation with attributes: The {{action}} action replaces the entire item, so dynamodb:Attributes cannot restrict access at the attribute level. That condition only applies to UpdateItem; use dynamodb:UpdateItem for attribute-level access control.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{action}} action replaces the entire item, so dynamodb:Attributes cannot restrict access at the attribute level. That condition only applies to UpdateItem; use dynamodb:UpdateItem for attribute-level access control."

Resolving the security warning Using "Effect": "Allow" with the NotPrincipal can be overly permissive. For example, this can grant permissions to anonymous principals. AWS recommends that you specify principals that need access using the Principal element. Alternatively, you can allow broad access and then add another statement that uses the NotPrincipal element with “Effect”: “Deny”.

AWS JSON policy elements: Principal

AWS JSON policy elements: NotPrincipal

Security Warning – ForAllValues with single valued key

Issue code: FORALLVALUES_WITH_SINGLE_VALUED_KEY Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB scan bypasses leading keys: The dynamodb:Scan operation returns all items in the table, bypassing the dynamodb:LeadingKeys restriction. Consider removing dynamodb:Scan.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The dynamodb:Scan operation returns all items in the table, bypassing the dynamodb:LeadingKeys restriction. Consider removing dynamodb:Scan."

Resolving the security warning AWS recommends that you use the ForAllValues only with multivalued conditions. The ForAllValues set operator tests whether the value of every member of the request set is a subset of the condition key set. The condition returns true if every key value in the request matches at least one value in the policy. It also returns true if there are no keys in the request, or if the key values resolve to a null data set, such as an empty string. To learn whether a condition supports a single value or multiple values, review the Actions, resources, and condition keys page for the service. Condition keys with the ArrayOf data type prefix are multivalued condition keys. For example, Amazon SES supports keys with single values (String) and the ArrayOfString multivalued data type.

Multivalued context keys

Security Warning – Pass role with NotResource

Issue code: PASS_ROLE_WITH_NOT_RESOURCE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB wrong condition for action: The condition key {{conditionKey}} does not apply to the {{action}} action. Use dynamodb:Select with read actions and dynamodb:ReturnValues with write actions.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{conditionKey}} does not apply to the {{action}} action. Use dynamodb:Select with read actions and dynamodb:ReturnValues with write actions."

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Using iam:PassRole in a policy with the NotResource element can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

Security Warning – Pass role with star in action and NotResource

Issue code: PASS_ROLE_WITH_STAR_IN_ACTION_AND_NOT_RESOURCE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Untrustworthy condition key: The {{key}} condition key is not recommended for access control as it can be spoofed/manipulated by the caller.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{key}} condition key is not recommended for access control as it can be spoofed/manipulated by the caller."

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Policies with a wildcard (*) in the Action and that include the NotResource element can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

Security Warning – Pass role with NotAction and NotResource

Issue code: PASS_ROLE_WITH_NOT_ACTION_AND_NOT_RESOURCE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Allow with NotPrincipal: Using Allow with NotPrincipal can be overly permissive. We recommend that you use Principal instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using Allow with NotPrincipal can be overly permissive. We recommend that you use Principal instead."

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Using the NotAction element and listing some resources in the NotResource element can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: NotAction

IAM JSON policy elements: Action

IAM JSON policy elements: NotResource

IAM JSON policy elements: Resource

Security Warning – Pass role with star in resource

Issue code: PASS_ROLE_WITH_STAR_IN_RESOURCE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

ForAllValues with single valued key: Using ForAllValues qualifier with the single-valued condition key {{key}} can be overly permissive. We recommend that you remove ForAllValues:.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using ForAllValues qualifier with the single-valued condition key {{key}} can be overly permissive. We recommend that you remove ForAllValues:."

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Policies that allow iam:PassRole and that include a wildcard (*) in the Resource element can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key. Some AWS services include their service namespace in the name of their role. This policy check takes these conventions into account while analyzing the policy to generate findings. For example, the following resource ARN might not generate a finding:

Pass role with NotResource: Using the iam:PassRole action with NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs instead.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: Resource

AWS managed policies with this security warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. One of those use cases is for administrators within your account. The following AWS managed policies provide administrator access and grant permissions to pass any IAM role to any service. AWS recommends that you attach the following AWS managed policies only to IAM identities that you consider administrators.

AdministratorAccess-Amplify The following AWS managed policies include permissions to iam:PassRole with a wildcard (*) in the resource and are on a deprecation path. For each of these policies, we updated the permission guidance, such as recommending a new AWS managed policy that supports the use case. To view alternatives to these policies, see the guides for each service.

AWSElasticBeanstalkFullAccess

AWSElasticBeanstalkService

AWSLambdaFullAccess

AWSLambdaReadOnlyAccess

AWSOpsWorksFullAccess

AWSOpsWorksRole

AWSDataPipelineRole

AmazonDynamoDBFullAccesswithDataPipeline

AmazonElasticMapReduceFullAccess

AmazonDynamoDBFullAccesswithDataPipeline

AmazonEC2ContainerServiceFullAccess The following AWS managed policies provide permissions for only service-linked roles, which allow AWS services to perform actions on your behalf. You cannot attach these policies to your IAM identities.

AWSServiceRoleForAmazonEKSNodegroup

Security Warning – Pass role with star in action and resource

Issue code: PASS_ROLE_WITH_STAR_IN_ACTION_AND_RESOURCE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the iam:PassRole action with NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs instead."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Pass role with star in action and NotResource: Using an action with a wildcard (*) and NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs instead.

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Policies with a wildcard (*) in the Action and Resource elements can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: Action

IAM JSON policy elements: Resource

AWS managed policies with this security warning

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. Some of those use cases are for administrators within your account. The following AWS managed policies provide administrator access and grant permissions to pass any IAM role to any AWS service. AWS recommends that you attach the following AWS managed policies to only the IAM identities that you consider administrators.

AdministratorAccess

IAMFullAccess

Security Warning – Pass role with star in resource and NotAction

Issue code: PASS_ROLE_WITH_STAR_IN_RESOURCE_AND_NOT_ACTION Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using an action with a wildcard (*) and NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs instead."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Pass role with NotAction and NotResource: Using NotAction with NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources.. We recommend that you specify resource ARNs instead.

Resolving the security warning To configure many AWS services, you must pass an IAM role to the service. To allow this you must grant the iam:PassRole permission to an identity (user, group of users, or role). Using the NotAction element in a policy with a wildcard (*) in the Resource element can allow your principals to access more services or features than you intended. AWS recommends that you specify allowed ARNs in the Resource element instead. Additionally, you can reduce permissions to a single service by using the iam:PassedToService condition key.

Passing a role to a service

iam:PassedToService

IAM JSON policy elements: NotAction

IAM JSON policy elements: Action

IAM JSON policy elements: Resource

Security Warning – Missing paired condition keys

Issue code: MISSING_PAIRED_CONDITION_KEYS Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using NotAction with NotResource can be overly permissive because it can allow iam:PassRole permissions on multiple resources.. We recommend that you specify resource ARNs instead."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Pass role with star in resource: Using the iam:PassRole action with wildcards (*) in the resource can be overly permissive because it allows iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement.

Resolving the security warning Some condition keys are more secure when paired with other related condition keys. AWS recommends that you include the related condition keys in the same condition block as the existing condition key. This makes the permissions granted through the policy more secure. For example, you can use the aws:VpcSourceIp condition key to compare the IP address from which a request was made with the IP address that you specify in the policy. AWS recommends that you add the related aws:SourceVPC condition key. This checks whether the request comes from the VPC that you specify in the policy and the IP address that you specify. 관련 용어

aws:VpcSourceIp global condition key

aws:SourceVPC global condition key

Global condition keys

Condition element

Overview of JSON policies

Security Warning – Deny with unsupported tag condition key for service

Issue code: DENY_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the iam:PassRole action with wildcards (*) in the resource can be overly permissive because it allows iam:PassRole permissions on multiple resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

arn:aws:iam::*:role/Service*

Resolving the security warning Using unsupported tag condition keys in the Condition element of a policy with "Effect": "Deny" can be overly permissive, because the condition is ignored for that service. AWS recommends that you remove the service actions that don’t support the condition key and create another statement to deny access to specific resources for those actions. If you use the aws:ResourceTag condition key and it’s not supported by a service action, then the key is not included in the request context. In this case, the condition in the Deny statement always returns false and the action is never denied. This happens even if the resource is tagged correctly. When a service supports the aws:ResourceTag condition key, you can use tags to control access to that service’s resources. This is known as attribute-based access control (ABAC). Services that don’t support these keys require you to control access to resources using resource-based access control (RBAC).

Note

Some services allow support for the aws:ResourceTag condition key for a subset of their resources and actions. IAM Access Analyzer returns findings for the service actions that are not supported. For example, Amazon S3 supports aws:ResourceTag for a subset of its resources. To view all of the resource types available in Amazon S3 that support the aws:ResourceTag condition key, see Resource types defined by Amazon S3 in the Service Authorization Reference. For example, assume that you want to deny access to untag delete specific resources that are tagged with the key-value pair status=Confidential. Also assume that AWS Lambda allows you to tag and untag resources, but doesn’t support the aws:ResourceTag condition key. To deny the delete actions for AWS App Mesh and AWS Backup if this tag is present, use the aws:ResourceTag condition key. For Lambda, use a resource naming convention that includes the "Confidential" prefix. Then include a separate statement that prevents deleting resources with that naming convention.

Pass role with star in action and resource: Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement.

Warning

Do not use the …IfExists version of the condition operator as a workaround for this finding. This means "Deny the action if the key is present in the request context and the values match. Otherwise, deny the action." In the previous example, including the lambda:DeleteFunction action in the DenyDeleteSupported statement with the StringEqualsIfExists operator always denies the action. For that action, the key is not present in the context, and every attempt to delete that resource type is denied, regardless of whether the resource is tagged. 관련 용어

Global condition keys

Comparing ABAC to RBAC

IAM JSON policy elements: Condition operators

Condition element

Overview of JSON policies

Security Warning – Deny NotAction with unsupported tag condition key for service

Issue code: DENY_NOTACTION_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using wildcards (*) in the action and the resource can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Pass role with star in resource and NotAction: Using a resource with wildcards (*) and NotAction can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement.

Resolving the security warning Using tag condition keys in the Condition element of a policy with the element NotAction and "Effect": "Deny" can be overly permissive. The condition is ignored for service actions that don’t support the condition key. AWS recommends that you rewrite the logic to deny a list of actions. If you use the aws:ResourceTag condition key with NotAction, any new or existing service actions that don’t support the key are not denied. AWS recommends that you explicitly list the actions that you want to deny. IAM Access Analyzer returns a separate finding for listed actions that don’t support the aws:ResourceTag condition key. For more information, see Security Warning – Deny with unsupported tag condition key for service. When a service supports the aws:ResourceTag condition key, you can use tags to control access to that service’s resources. This is known as attribute-based access control (ABAC). Services that don’t support these keys require you to control access to resources using resource-based access control (RBAC). 관련 용어

Global condition keys

Comparing ABAC to RBAC

IAM JSON policy elements: Condition operators

Condition element

Overview of JSON policies

Security Warning – Restrict access to service principal

Issue code: RESTRICT_ACCESS_TO_SERVICE_PRINCIPAL Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using a resource with wildcards (*) and NotAction can be overly permissive because it allows iam:PassRole permissions on all resources. We recommend that you specify resource ARNs or add the iam:PassedToService condition key to your statement."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing paired condition keys: Using the condition key {{conditionKeyName}} can be overly permissive without also using the following condition keys: {{recommendedKeys}}. Condition keys like this one are more secure when paired with a related key. We recommend that you add the related condition keys to the same condition block.

Resolving the security warning You can specify AWS services in the Principal element of a resource-based policy using a service principal, which is an identifier for the service. When granting access to a service principal to act on your behalf, restrict access. You can prevent overly permissive policies by using the aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths condition keys to restrict access to a specific source, such as a specific resource ARN, AWS account, organization ID, or organization paths. Restricting access helps you prevent a security issue called the confused deputy problem. 관련 용어

AWS service principals

AWS global condition keys: aws:SourceAccount

AWS global condition keys: aws:SourceArn

AWS global condition keys: aws:SourceOrgId

AWS global condition keys: aws:SourceOrgPaths

The confused deputy problem

Security Warning – Missing condition key for oidc principal

Issue code: MISSING_CONDITION_KEY_FOR_OIDC_PRINCIPAL Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the condition key {{conditionKeyName}} can be overly permissive without also using the following condition keys: {{recommendedKeys}}. Condition keys like this one are more secure when paired with a related key. We recommend that you add the related condition keys to the same condition block."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Deny with unsupported tag condition key for service: Using the effect Deny with the tag condition key {{conditionKeyName}} and actions for services with the following prefixes can be overly permissive: {{serviceNames}}. Actions for the listed services are not denied by this statement. We recommend that you move these actions to a different statement without this condition key.

Resolving the security warning Using an Open ID Connect principal without a condition can be overly permissive. Add condition keys with a prefix that matches your federated OIDC principals to ensure that only the intended identity provider assumes the role. 관련 용어

Creating a role for web identity or OpenID Connect Federation (console)

Security Warning – Missing github repo condition key

Issue code: MISSING_GITHUB_REPO_CONDITION_KEY Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the effect Deny with the tag condition key {{conditionKeyName}} and actions for services with the following prefixes can be overly permissive: {{serviceNames}}. Actions for the listed services are not denied by this statement. We recommend that you move these actions to a different statement without this condition key."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "DenyDeleteSupported",
            "Effect": "Deny",
            "Action": [
                "appmesh:DeleteMesh", 
                "backup:DeleteBackupPlan"
                ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/status": "Confidential"
                }
            }
        },
        {
            "Sid": "DenyDeleteUnsupported",
            "Effect": "Deny",
            "Action": "lambda:DeleteFunction",
            "Resource": "arn:aws:lambda:*:123456789012:function:status-Confidential*"
        }
    ]
}

Resolving the security warning If you use GitHub as an OIDC IdP, best practice is to limit the entities that can assume the role associated with the IAM IdP. When you include a Condition statement in a role trust policy, you can limit the role to a specific GitHub organization, repository, or branch. You can use the condition key token.actions.githubusercontent.com:sub to limit access. We recommend that you limit the condition to a specific set of repositories or branches. If you do not include this condition, then GitHub Actions from organizations or repositories outside of your control are able to assume roles associated with the GitHub IAM IdP in your AWS account. 관련 용어

Configuring a role for GitHub OIDC identity provider

Security Warning – String like operator with ARN condition keys

Issue code: STRING_LIKE_OPERATOR_WITH_ARN_CONDITION_KEYS Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Deny NotAction with unsupported tag condition key for service: Using the effect Deny with NotAction and the tag condition key {{conditionKeyName}} can be overly permissive because some service actions are not denied by this statement. This is because the condition key doesn't apply to some service actions. We recommend that you use Action instead of NotAction.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the effect Deny with NotAction and the tag condition key {{conditionKeyName}} can be overly permissive because some service actions are not denied by this statement. This is because the condition key doesn't apply to some service actions. We recommend that you use Action instead of NotAction."

Resolving the security warning AWS recommends that you use ARN operators instead of string operators when comparing ARNs to ensure proper access restriction based on ARN condition values. Update the StringLike operator to the ArnLike operator in your Condition element whenever the specified key is used. These AWS managed policies are exceptions to this security warning:

AmazonSecurityLakeAdministrator

AWSCodePipeline_FullAccess

AWSCodePipeline_ReadOnlyAccess

S3UnlockBucketPolicy

SQSUnlockQueuePolicy 관련 용어

Amazon Resource Name (ARN) condition operators

String condition operators

AWS managed policies

Security Warning – DynamoDB attributes without select

Issue code: DYNAMODB_ATTRIBUTES_WITHOUT_SELECT Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Restrict access to service principal: Granting access to a service principal without specifying a source is overly permissive. Use aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths condition key to grant fine-grained access.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Granting access to a service principal without specifying a source is overly permissive. Use aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths condition key to grant fine-grained access."

Resolving the security warning Add a StringEquals condition that sets dynamodb:Select to SPECIFIC_ATTRIBUTES in the same statement as the dynamodb:Attributes condition. DynamoDB evaluates dynamodb:Attributes only for requests that specify the attributes to return. Without this condition, a read request that omits a projection expression returns the entire item. 관련 용어

Using IAM policy conditions for fine-grained access control

IAM JSON policy elements: Condition operators

Security Warning – S3 prefix in negative context

Issue code: S3_PREFIX_IN_NEGATIVE_CONTEXT Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing condition key for oidc principal: Using an Open ID Connect principal without a condition can be overly permissive. Add condition keys with a prefix that matches your federated OIDC principals to ensure that only the intended identity provider assumes the role.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using an Open ID Connect principal without a condition can be overly permissive. Add condition keys with a prefix that matches your federated OIDC principals to ensure that only the intended identity provider assumes the role."

Resolving the security warning To restrict listing to specific prefixes, use one of the following patterns:

Allow with StringLike – Grant s3:ListBucket with a StringLike condition on s3:prefix listing the prefixes you want to permit. Requests that supply a different prefix are not covered by this Allow and cannot list those objects.

Deny with StringNotLike – Deny s3:ListBucket with a StringNotLike condition on s3:prefix listing the prefixes you want to allow. A request that omits the prefix or supplies a shorter prefix does not match the allowed set and is denied. A Deny with StringLike or an Allow with StringNotLike does not effectively restrict access because a caller can bypass the condition by specifying a shorter prefix (for example, priv instead of private/) that does not match the condition value. 관련 용어

Amazon S3 condition key examples

IAM JSON policy elements: Condition operators

IAM policy elements: Condition

Security Warning – ForAnyValue with audience claim type

Issue code: FORANYVALUE_WITH_AUDIENCE_CLAIM_TYPE Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Missing github repo condition key: Granting a federated GitHub principal permissions without a condition key can allow more sources to assume the role than you intended. Add the token.actions.githubusercontent.com:sub condition key and specify the branch and repository name in the value.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Granting a federated GitHub principal permissions without a condition key can allow more sources to assume the role than you intended. Add the token.actions.githubusercontent.com:sub condition key and specify the branch and repository name in the value."

Resolving the security warning AWS recommends that you do not use the ForAnyValue set operator with single-valued condition keys. Use set operators only with multivalued condition keys. Remove the ForAnyValue set operator. 관련 용어

Single-valued vs. multivalued context keys

Single-valued context key policy examples

Security Warning – DynamoDB attributes without return values

Issue code: DYNAMODB_ATTRIBUTES_WITHOUT_RETURN_VALUES Finding type: SECURITY_WARNING 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

String like operator with ARN condition keys: Use the operator type {{allowed}} instead of operator {{operator}} for the condition key {{key}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Use the operator type {{allowed}} instead of operator {{operator}} for the condition key {{key}}."

Resolving the security warning Add a condition that limits dynamodb:ReturnValues to NONE, UPDATED_OLD, or UPDATED_NEW in the same statement as the dynamodb:Attributes condition. Without this limit, a write that sets dynamodb:ReturnValues to ALL_OLD or ALL_NEW returns the entire item, including attributes outside the ones you allowed.

Suggestion – Empty array action

Issue code: EMPTY_ARRAY_ACTION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB attributes without select: Restricting dynamodb:Attributes without also setting dynamodb:Select to SPECIFIC_ATTRIBUTES allows all attributes to be returned on read requests that omit a projection expression. We recommend that you also set dynamodb:Select to SPECIFIC_ATTRIBUTES.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Restricting dynamodb:Attributes without also setting dynamodb:Select to SPECIFIC_ATTRIBUTES allows all attributes to be returned on read requests that omit a projection expression. We recommend that you also set dynamodb:Select to SPECIFIC_ATTRIBUTES."

제안 해결 Statements must include either an Action or NotAction element that includes a set of actions. When the element is empty, the policy statement provides no permissions. Specify actions in the Action element.

IAM JSON policy elements: Action

Suggestion – Empty array condition

Issue code: EMPTY_ARRAY_CONDITION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

S3 prefix in negative context: Using the s3:prefix condition key in a Deny statement or with a negated string operator does not block listing the objects under the matching prefixes. A request that specifies a shorter prefix does not match the condition and can still list those objects. To restrict listing to specific prefixes, use s3:prefix with StringLike in an Allow statement, or use a Deny statement with StringNotLike.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the s3:prefix condition key in a Deny statement or with a negated string operator does not block listing the objects under the matching prefixes. A request that specifies a shorter prefix does not match the condition and can still list those objects. To restrict listing to specific prefixes, use s3:prefix with StringLike in an Allow statement, or use a Deny statement with StringNotLike."

제안 해결 The optional Condition element structure requires that you use a condition operator and a key-value pair. When the condition value is empty, the condition returns true and the policy statement provides no permissions. Specify a condition value.

IAM JSON policy elements: Condition

Suggestion – Empty array condition ForAllValues

Issue code: EMPTY_ARRAY_CONDITION_FORALLVALUES Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

ForAnyValue with audience claim type: Using ForAnyValue qualifier with the single-valued condition key {{key}} can be overly permissive. We recommend that you remove ForAnyValue:.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using ForAnyValue qualifier with the single-valued condition key {{key}} can be overly permissive. We recommend that you remove ForAnyValue:."

제안 해결 The Condition element structure requires that you use a condition operator and a key-value pair. The ForAllValues set operator tests whether the value of every member of the request set is a subset of the condition key set. When you use ForAllValues with an empty condition key, the condition matches only if there are no keys in the request. AWS recommends that if you want to test whether a request context is empty, use the Null condition operator instead.

Multivalued context keys

Null condition operator

IAM JSON policy elements: Condition

Suggestion – Empty array condition ForAnyValue

Issue code: EMPTY_ARRAY_CONDITION_FORANYVALUE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

DynamoDB attributes without return values: Restricting dynamodb:Attributes without limiting dynamodb:ReturnValues allows write operations to return the entire item, which can expose attributes outside the allowed list. We recommend that you restrict dynamodb:ReturnValues to NONE, UPDATED_OLD, or UPDATED_NEW.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Restricting dynamodb:Attributes without limiting dynamodb:ReturnValues allows write operations to return the entire item, which can expose attributes outside the allowed list. We recommend that you restrict dynamodb:ReturnValues to NONE, UPDATED_OLD, or UPDATED_NEW."

제안 해결 The Condition element structure requires that you use a condition operator and a key-value pair. The ForAnyValues set operator tests whether at least one member of the set of request values matches at least one member of the set of condition key values. When you use ForAnyValues with an empty condition key, the condition never matches. This means that the statement has no effect on the policy. AWS recommends that you rewrite the condition.

Multivalued context keys

IAM JSON policy elements: Condition

Suggestion – Empty array condition IfExists

Issue code: EMPTY_ARRAY_CONDITION_IFEXISTS Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array action: This statement includes no actions and does not affect the policy. Specify actions.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "This statement includes no actions and does not affect the policy. Specify actions."

제안 해결 The ...IfExists suffix edits a condition operator. It means that if the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, evaluate the condition element as true. When you use ...IfExists with an empty condition key, the condition matches only if there are no keys in the request. AWS recommends that if you want to test whether a request context is empty, use the Null condition operator instead.

...IfExists condition operators

IAM JSON policy elements: Condition

Suggestion – Empty array principal

Issue code: EMPTY_ARRAY_PRINCIPAL Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array condition: There are no values for the condition key {{key}} and it does not affect the policy. Specify conditions.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "There are no values for the condition key {{key}} and it does not affect the policy. Specify conditions."

제안 해결 You must use the Principal or NotPrincipal element in the trust policies for IAM roles and in resource-based policies. Resource-based policies are policies that you embed directly in a resource. When you provide an empty array in a statement's Principal element, the statement has no effect on the policy. AWS recommends that you specify the principals that should have access to the resource.

IAM JSON policy elements: Principal

IAM JSON policy elements: NotPrincipal

Suggestion – Empty array resource

Issue code: EMPTY_ARRAY_RESOURCE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array condition ForAllValues: The ForAllValues prefix with an empty condition key matches only if the key {{key}} is missing from the request context. To determine if the request context is empty, we recommend that you use the Null condition operator with the value of true instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The ForAllValues prefix with an empty condition key matches only if the key {{key}} is missing from the request context. To determine if the request context is empty, we recommend that you use the Null condition operator with the value of true instead."

제안 해결 Statements must include either a Resource or a NotResource element. When you provide an empty array in a statement's resource element, the statement has no effect on the policy. AWS recommends that you specify Amazon Resource Names (ARNs) for resources.

IAM JSON policy elements: Resource

IAM JSON policy elements: NotResource

Suggestion – Empty object condition

Issue code: EMPTY_OBJECT_CONDITION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array condition ForAnyValue: The ForAnyValue prefix with an empty condition key {{key}} never matches the request context and it does not affect the policy. Specify conditions.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The ForAnyValue prefix with an empty condition key {{key}} never matches the request context and it does not affect the policy. Specify conditions."

제안 해결 The Condition element structure requires that you use a condition operator and a key-value pair. When you provide an empty object in a statement's condition element, the statement has no effect on the policy. Remove the optional element or specify conditions.

IAM JSON policy elements: Condition

Suggestion – Empty object principal

Issue code: EMPTY_OBJECT_PRINCIPAL Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array condition IfExists: The IfExists suffix with an empty condition key matches only if the key {{key}} is missing from the request context. To determine if the request context is empty, we recommend that you use the Null condition operator with the value of true instead.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The IfExists suffix with an empty condition key matches only if the key {{key}} is missing from the request context. To determine if the request context is empty, we recommend that you use the Null condition operator with the value of true instead."

제안 해결 You must use the Principal or NotPrincipal element in the trust policies for IAM roles and in resource-based policies. Resource-based policies are policies that you embed directly in a resource. When you provide an empty object in a statement's Principal element, the statement has no effect on the policy. AWS recommends that you specify the principals that should have access to the resource.

IAM JSON policy elements: Principal

IAM JSON policy elements: NotPrincipal

Suggestion – Empty Sid value

Issue code: EMPTY_SID_VALUE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array principal: This statement includes no principals and does not affect the policy. Specify principals.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "This statement includes no principals and does not affect the policy. Specify principals."

제안 해결 The optional Sid (statement ID) element allows you to enter an identifier that you provide for the policy statement. You can assign an Sid value to each statement in a statement array. If you choose to use the Sid element, you must provide a string value. 관련 용어

IAM JSON policy elements: Sid

Suggestion – Equivalent to null false

Issue code: EQUIVALENT_TO_NULL_FALSE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty array resource: This statement includes no resources and does not affect the policy. Specify resources.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "This statement includes no resources and does not affect the policy. Specify resources."

제안 해결 Replace the current condition key with the recommended key set to false. This change improves policy clarity and ensures more reliable condition evaluation. Update your condition block to use {recommendedKey}: false instead of the current key-operator combination. 관련 용어

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

Suggestion – Equivalent to null true

Issue code: EQUIVALENT_TO_NULL_TRUE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty object condition: This condition block is empty and it does not affect the policy. Specify conditions.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "This condition block is empty and it does not affect the policy. Specify conditions."

제안 해결 Replace the current condition key with the recommended key set to true. This change improves policy clarity and ensures more reliable condition evaluation. Update your condition block to use {recommendedKey}: true instead of the current key-operator combination. 관련 용어

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

Suggestion – Improve IP range

Issue code: IMPROVE_IP_RANGE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty object principal: This statement includes no principals and does not affect the policy. Specify principals.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "This statement includes no principals and does not affect the policy. Specify principals."

제안 해결 IP address conditions must be in the standard CIDR format, such as 203.0.113.0/24 or 2001:DB8:1234:5678::/64. When you include non-zero bits after the masked bits, they are not considered for the condition. AWS recommends that you use the new address included in the message.

IP address condition operators

IAM JSON policy elements: Condition

Suggestion – Null with qualifier

Issue code: NULL_WITH_QUALIFIER Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Empty Sid value: Add a value to the empty string in the Sid element.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Add a value to the empty string in the Sid element."

제안 해결 In the Condition element, you build expressions in which you use condition operators like equal or less than to compare a condition in the policy against keys and values in the request context. For requests that include multiple values for a single condition key, you must use the ForAllValues or ForAnyValue set operators. When you use the Null condition operator with ForAllValues, the statement always returns true. When you use the Null condition operator with ForAnyValue, the statement always returns false. AWS recommends that you use the StringLike condition operator with these set operators. 관련 용어

Multivalued context keys

Null condition operator

Condition element

Suggestion – Private IP address subset

Issue code: PRIVATE_IP_ADDRESS_SUBSET Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Equivalent to null false: We recommend replacing the key {{key}} in the condition block of {{operator}} with {{{recommendedKey}}: false} to ensure better enforcement of the condition.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "We recommend replacing the key {{key}} in the condition block of {{operator}} with {{{recommendedKey}}: false} to ensure better enforcement of the condition."

제안 해결 The global condition key aws:SourceIp works only for public IP address ranges. When your Condition element includes a mix of private and public IP addresses, the statement might not have the desired effect. You can specify private IP addresses using aws:VpcSourceIP.

Note

The global condition key aws:VpcSourceIP matches only if the request originates from the specified IP address and it goes through a VPC endpoint.

aws:SourceIp global condition key

aws:VpcSourceIp global condition key

IP address condition operators

IAM JSON policy elements: Condition

Suggestion – Private NotIpAddress subset

Issue code: PRIVATE_NOT_IP_ADDRESS_SUBSET Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Equivalent to null true: We recommend replacing the key {{key}} in the condition block of {{operator}} with {{{recommendedKey}}: true} to ensure better enforcement of the condition.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "We recommend replacing the key {{key}} in the condition block of {{operator}} with {{{recommendedKey}}: true} to ensure better enforcement of the condition."

제안 해결 The global condition key aws:SourceIp works only for public IP address ranges. When your Condition element includes the NotIpAddress condition operator and a mix of private and public IP addresses, the statement might not have the desired effect. Every public IP addresses that is not specified in the policy will match. No private IP addresses will match. To achieve this effect, you can use NotIpAddress with aws:VpcSourceIP and specify the private IP addresses that should not match.

aws:SourceIp global condition key

aws:VpcSourceIp global condition key

IP address condition operators

IAM JSON policy elements: Condition

Suggestion – Redundant action

Issue code: REDUNDANT_ACTION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Improve IP range: The non-zero bits in the IP address after the masked bits are ignored. Replace address with {{addr}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The non-zero bits in the IP address after the masked bits are ignored. Replace address with {{addr}}."

제안 해결 When you use wildcards (*) in the Action element, you can include redundant permissions. AWS recommends that you review your policy and include only the permissions that you need. This can help you remove redundant actions. For example, the following actions include the iam:GetCredentialReport action twice.

Null with qualifier: Avoid using the Null condition operator with the ForAllValues or ForAnyValue qualifiers because they always return a true or false respectively.

In this example, permissions are defined for every IAM action that begins with Get or List. When IAM adds additional get or list operations, this policy will allow them. You might want to allow all of these read-only actions. The iam:GetCredentialReport action is already included as part of iam:Get*. To remove the duplicate permissions, you could remove iam:GetCredentialReport. You receive a finding for this policy check when all of the contents of an action are redundant. In this example, if the element included iam:*CredentialReport, it is not considered redundant. That includes iam:GetCredentialReport, which is redundant, and iam:GenerateCredentialReport, which is not. Removing either iam:Get* or iam:*CredentialReport would change the policy's permissions.

IAM JSON policy elements: Action

AWS managed policies with this suggestion

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. Redundant actions do not affect the permissions granted by the policy. When using an AWS managed policy as a reference to create your customer managed policy, AWS recommends that you remove redundant actions from your policy.

Suggestion – Redundant condition value num

Issue code: REDUNDANT_CONDITION_VALUE_NUM Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Avoid using the Null condition operator with the ForAllValues or ForAnyValue qualifiers because they always return a true or false respectively."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Private IP address subset: The values for condition key aws:SourceIp include a mix of private and public IP addresses. The private addresses will not have the desired effect. aws:SourceIp works only for public IP address ranges. To define permissions for private IP ranges, use aws:VpcSourceIp.

제안 해결 When you use numeric condition operators for similar values in a condition key, you can create an overlap that results in redundant permissions. For example, the following Condition element includes multiple aws:MultiFactorAuthAge conditions that have an age overlap of 1200 seconds.

"findingDetails": "The values for condition key aws:SourceIp include a mix of private and public IP addresses. The private addresses will not have the desired effect. aws:SourceIp works only for public IP address ranges. To define permissions for private IP ranges, use aws:VpcSourceIp."

In this example, the permissions are defined if multi-factor authentication (MFA) was completed less than 3600 seconds (1 hour) ago. You could remove the redundant 2700 value.

Numeric condition operators

IAM JSON policy elements: Condition

Suggestion – Redundant resource

Issue code: REDUNDANT_RESOURCE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Private NotIpAddress subset: The values for condition key aws:SourceIp include a mix of private and public IP addresses. The private addresses have no effect. aws:SourceIp works only for public IP address ranges. To define permissions for private IP ranges, use aws:VpcSourceIp.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The values for condition key aws:SourceIp include a mix of private and public IP addresses. The private addresses have no effect. aws:SourceIp works only for public IP address ranges. To define permissions for private IP ranges, use aws:VpcSourceIp."

제안 해결 When you use wildcards (*) in Amazon Resource Names (ARNs), you can create redundant resource permissions. For example, the following Resource element includes multiple ARNs with redundant permissions.

Redundant action: The {{redundantActionCount}} action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: {{redundantAction}}.

In this example, the permissions are defined for any role with a name starting with jane. You could remove the redundant jane-admin and jane-s3only ARNs without changing the resulting permissions. This does make the policy dynamic. It will define permissions for any future roles that begin with jane. If the intention of the policy is to allow access to a static number of roles, then remove the last ARN and list only the ARNs that should be defined.

IAM JSON policy elements: Resource

AWS managed policies with this suggestion

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases. Redundant resources do not affect the permissions granted by the policy. When using an AWS managed policy as a reference to create your customer managed policy, AWS recommends that you remove redundant resources from your policy.

Suggestion – Redundant statement

Issue code: REDUNDANT_STATEMENT Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{redundantActionCount}} action(s) are redundant because they provide similar permissions. Update the policy to remove the redundant action such as: {{redundantAction}}."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"Action": [
        "iam:Get*",
        "iam:List*",
        "iam:GetCredentialReport"
    ],

제안 해결 The Statement element is the main element for a policy. This element is required. The Statement element can contain a single statement or an array of individual statements. When you include the same statement more than once in a long policy, the statements are is redundant. You can remove one of the statements without affecting the permissions granted by the policy. When someone edits a policy, they might change one of the statements without updating the duplicate. This might result in more permissions than intended.

IAM JSON policy elements: Statement

Suggestion – Wildcard in service name

Issue code: WILDCARD_IN_SERVICE_NAME Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Redundant condition value num: Multiple values in {{operator}} are redundant. Replace with the {{greatest/least}} single value for {{key}}.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Multiple values in {{operator}} are redundant. Replace with the {{greatest/least}} single value for {{key}}."

제안 해결 When you include the name of an AWS service in a policy, AWS recommends that you do not include wildcards (*, ?). This might add permissions for future services that you do not intend. For example, there are more than a dozen AWS services with the word *code* in their name.

"Condition": {
        "NumericLessThan": {
          "aws:MultiFactorAuthAge": [
            "2700",
            "3600"
          ]
        }
      }

IAM JSON policy elements: Resource

Suggestion – Allow with unsupported tag condition key for service

Issue code: ALLOW_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Redundant resource: The {{redundantResourceCount}} resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*)

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The {{redundantResourceCount}} resource ARN(s) are redundant because they reference the same resource. Review the use of wildcards (*)"

제안 해결 Using unsupported tag condition keys in the Condition element of a policy with "Effect": "Allow" does not affect the permissions granted by the policy, because the condition is ignored for that service action. AWS recommends that you remove the actions for services that don’t support the condition key and create another statement to allow access to specific resources in that service. If you use the aws:ResourceTag condition key and it’s not supported by a service action, then the key is not included in the request context. In this case, the condition in the Allow statement always returns false and the action is never allowed. This happens even if the resource is tagged correctly. When a service supports the aws:ResourceTag condition key, you can use tags to control access to that service’s resources. This is known as attribute-based access control (ABAC). Services that don’t support these keys require you to control access to resources using resource-based access control (RBAC).

Note

Some services allow support for the aws:ResourceTag condition key for a subset of their resources and actions. IAM Access Analyzer returns findings for the service actions that are not supported. For example, Amazon S3 supports aws:ResourceTag for a subset of its resources. To view all of the resource types available in Amazon S3 that support the aws:ResourceTag condition key, see Resource types defined by Amazon S3 in the Service Authorization Reference. For example, assume that you want to allow team members to view details for specific resources that are tagged with the key-value pair team=BumbleBee. Also assume that AWS Lambda allows you to tag resources, but doesn’t support the aws:ResourceTag condition key. To allow view actions for AWS App Mesh and AWS Backup if this tag is present, use the aws:ResourceTag condition key. For Lambda, use a resource naming convention that includes the team name as a prefix. Then include a separate statement that allows viewing resources with that naming convention.

"Resource": [
            "arn:aws:iam::111122223333:role/jane-admin",
            "arn:aws:iam::111122223333:role/jane-s3only",
            "arn:aws:iam::111122223333:role/jane*"
        ],

Warning

Do not use the Notversion of the condition operator with "Effect": "Allow" as a workaround for this finding. These condition operators provide negated matching. This means that after the condition is evaluated, the result is negated. In the previous example, including the lambda:GetFunction action in the AllowViewSupported statement with the StringNotEquals operator always allows the action, regardless of whether the resource is tagged. Do not use the …IfExists version of the condition operator as a workaround for this finding. This means "Allow the action if the key is present in the request context and the values match. Otherwise, allow the action." In the previous example, including the lambda:GetFunction action in the AllowViewSupported statement with the StringEqualsIfExists operator always allows the action. For that action, the key is not present in the context, and every attempt to view that resource type is allowed, regardless of whether the resource is tagged. 관련 용어

Global condition keys

IAM JSON policy elements: Condition operators

Condition element

Overview of JSON policies

Suggestion – Allow NotAction with unsupported tag condition key for service

Issue code: ALLOW_NOTACTION_WITH_UNSUPPORTED_TAG_CONDITION_KEY_FOR_SERVICE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Redundant statement: The statements are redundant because they provide identical permissions. Update the policy to remove the redundant statement.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The statements are redundant because they provide identical permissions. Update the policy to remove the redundant statement."

제안 해결 Using unsupported tag condition keys in the Condition element of a policy with the element NotAction and "Effect": "Allow" does not affect the permissions granted by the policy. The condition is ignored for service actions that don’t support the condition key. AWS recommends that you rewrite the logic to allow a list of actions. If you use the aws:ResourceTag condition key with NotAction, any new or existing service actions that don’t support the key are not allowed. AWS recommends that you explicitly list the actions that you want to allow. IAM Access Analyzer returns a separate finding for listed actions that don’t support the aws:ResourceTag condition key. For more information, see Suggestion – Allow with unsupported tag condition key for service. When a service supports the aws:ResourceTag condition key, you can use tags to control access to that service’s resources. This is known as attribute-based access control (ABAC). Services that don’t support these keys require you to control access to resources using resource-based access control (RBAC). 관련 용어

Global condition keys

Comparing ABAC to RBAC

IAM JSON policy elements: Condition operators

Condition element

Overview of JSON policies

Suggestion – Recommended condition key for service principal

Issue code: RECOMMENDED_CONDITION_KEY_FOR_SERVICE_PRINCIPAL Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Wildcard in service name: Avoid using wildcards (*, ?) in the service name because it might grant unintended access to other AWS services with similar names.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Avoid using wildcards (*, ?) in the service name because it might grant unintended access to other AWS services with similar names."

제안 해결 You can specify AWS services in the Principal element of a resource-based policy using a service principal, which is an identifier for the service. You should use the aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths condition keys when granting access to service principals instead of other condition keys, such as aws:Referer. This helps you prevent a security issue called the confused deputy problem. 관련 용어

AWS service principals

AWS global condition keys: aws:SourceAccount

AWS global condition keys: aws:SourceArn

AWS global condition keys: aws:SourceOrgId

AWS global condition keys: aws:SourceOrgPaths

The confused deputy problem

Suggestion – Irrelevant condition key in policy

Issue code: IRRELEVANT_CONDITION_KEY_IN_POLICY Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"Resource": "arn:aws:*code*::111122223333:*"

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Allow with unsupported tag condition key for service: Using the effect Allow with the tag condition key {{conditionKeyName}} and actions for services with the following prefixes does not affect the policy: {{serviceNames}}. Actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key.

제안 해결 Some condition keys aren't relevant for resource-based policies. For example, the s3:ResourceAccount condition key isn't relevant for the resource-based policy attached to an Amazon S3 bucket or Amazon S3 access point resource type. You should use the condition key in an identity-based policy to control access to the resource. 관련 용어

Identity-based policies and resource-based policies

Suggestion – Redundant key due to wildcard in condition

Issue code: REDUNDANT_KEY_DUE_TO_WILDCARD_IN_CONDITION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the effect Allow with the tag condition key {{conditionKeyName}} and actions for services with the following prefixes does not affect the policy: {{serviceNames}}. Actions for the listed service are not allowed by this statement. We recommend that you move these actions to a different statement without this condition key."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowViewSupported",
            "Effect": "Allow",
            "Action": [
                "appmesh:DescribeMesh", 
                "backup:GetBackupPlan"
                ],
            "Resource": "*",
            "Condition": {
                "StringEquals": {
                    "aws:ResourceTag/team": "BumbleBee"
                }
            }
        },
        {
            "Sid": "AllowViewUnsupported",
            "Effect": "Allow",
            "Action": "lambda:GetFunction",
            "Resource": "arn:aws:lambda:*:123456789012:function:team-BumbleBee*"
        }
    ]
}

제안 해결 Remove the redundant condition key from your policy. The key is always matched due to the wildcard pattern, making it unnecessary. Simplify your condition block by removing this key while maintaining the same effective permissions. 관련 용어

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

Suggestion – Redundant principal in role trust policy

Issue code: REDUNDANT_PRINCIPAL_IN_ROLE_TRUST_POLICY Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

Allow NotAction with unsupported tag condition key for service: Using the effect Allow with NotAction and the tag condition key {{conditionKeyName}} allows only service actions that support the condition key. The condition key doesn't apply to some service actions. We recommend that you use Action instead of NotAction.

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "Using the effect Allow with NotAction and the tag condition key {{conditionKeyName}} allows only service actions that support the condition key. The condition key doesn't apply to some service actions. We recommend that you use Action instead of NotAction."

제안 해결 If you specify both an assumed-role principal and its parent role in the Principal element of a policy, it does not allow or deny any different permissions. For example, it is redundant if you specify the Principal element using the following format:

Recommended condition key for service principal: To restrict access to the service principal {{servicePrincipalPrefix}} operating on your behalf, we recommend aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths instead of {{key}}.

We recommend removing the assumed-role principal. 관련 용어

Role session principals

Suggestion – Redundant statement due to wildcard in condition

Issue code: REDUNDANT_STATEMENT_DUE_TO_WILDCARD_IN_CONDITION Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "To restrict access to the service principal {{servicePrincipalPrefix}} operating on your behalf, we recommend aws:SourceArn, aws:SourceAccount, aws:SourceOrgID, or aws:SourceOrgPaths instead of {{key}}."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Irrelevant condition key in policy: The condition key {{condition-key}} is not relevant for the {{resource-type}} policy.  Use this key in an identity-based policy to govern access to this resource.

제안 해결 Remove the condition key that doesn't match any values. This key creates an unreachable condition that will never be satisfied, making it redundant. Clean up your policy by removing this key to improve readability and performance. 관련 용어

IAM policy elements: Condition

Conditions with multiple context keys or values

AWS global condition context keys

Suggestion – Confirm audience claim type

Issue code: CONFIRM_AUDIENCE_CLAIM_TYPE Finding type: SUGGESTION 결과 세부 정보 AWS Management Console에서 이 검사의 결과는 다음 메시지를 포함합니다.

"findingDetails": "The condition key {{condition-key}} is not relevant for the {{resource-type}} policy.  Use this key in an identity-based policy to govern access to this resource."

AWS CLI·AWS API의 프로그래밍 방식 호출에서 이 검사의 결과는 다음 메시지를 포함합니다.

Redundant key due to wildcard in condition: The key {{key}} in the condition block of {{operator}} is redundant because it is always matched. Remove this key to simplify the condition.

제안 해결 The aud (audience) claim key is a unique identifier for your app that is issued to you when you register your app with the IdP and identifies the recipients that the JSON web token is intended for. Audience claims can be multivalued or single-valued. If the claim is multivalued, use a ForAllValues or ForAnyValue condition set operator. If the claim is single-valued, do not use a condition set operator. 관련 용어

Creating a role for web identity or OpenID Connect Federation (console)

Multivalued context keys

Single-valued vs. multivalued condition keys

"findingDetails": "The key {{key}} in the condition block of {{operator}} is redundant because it is always matched. Remove this key to simplify the condition."

Redundant principal in role trust policy: The assumed-role principal {{redundant_principal}} is redundant with its parent role {{parent_role}}. Remove the assumed-role principal.

"findingDetails": "The assumed-role principal {{redundant_principal}} is redundant with its parent role {{parent_role}}. Remove the assumed-role principal."

"Principal": {
            "AWS": [
            "arn:aws:iam::AWS-account-ID:role/rolename",
            "arn:aws:iam::AWS-account-ID:assumed-role/rolename/rolesessionname"
        ]

Redundant statement due to wildcard in condition: The key {{key}} in the condition block of {{operator}} does not match any values. Remove this key to simplify the condition.

"findingDetails": "The key {{key}} in the condition block of {{operator}} does not match any values. Remove this key to simplify the condition."

Confirm audience claim type: The "{{key}}" ({{audienceType}}) claim key identifies the recipients that the JSON web token is intended for. Because this claim is single-valued, do not use a qualifier.

더 알아보기 (Learn more)

• IAM Access Analyzer로 정책 검증
• 정책 검증용 검사
• IAM 정책 문법