# 如何写condition

常用的condition：

<table><thead><tr><th width="185.33333333333331">Condition key</th><th width="378">Description</th><th>policy example</th></tr></thead><tbody><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag">aws:RequestTag</a></td><td>根据请求方的tag key+value 过滤允许发起请求的是谁。例如，您可以检查请求是否包含tag key "usage" 并具有tag value "production" 。</td><td><a data-footnote-ref href="#user-content-fn-1">查看示例</a></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag">aws:ResourceTag</a></td><td><p>根据资源的tag过滤可以访问哪些资源.</p><p>如果资源包含指定的tag，与 请求方的tag一致，则允许执行操作。</p></td><td><a data-footnote-ref href="#user-content-fn-2">查看示例</a></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys">aws:TagKeys</a></td><td>支持要求在请求中传递的tag key有哪些来筛选访问，由于可在一个请求中包含多个标签键/值对，因此，请求内容可以是多值请求。在此情况下，您必须使用 ForAllValues 或 ForAnyValue 集合运算符。</td><td><a data-footnote-ref href="#user-content-fn-3">查看示例</a></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip">aws:SourceIp</a></td><td>当请求不是通过 VPC 端点发起时，限制对可信网络公共 IP 范围的访问。最常见的情况是从内部企业网络访问 AWS 控制台。</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc">aws:SourceVpc</a></td><td>限制从可信网络中特定 VPC ID 的访问。例如，在 Amazon EC2 实例上运行的应用程序APP 使用实例配置文件、部署在 VPC 中的 Lambda 函数或配置了 VPC 网络连接的 Glue 爬虫。</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia">aws:CalledVia</a></td><td>提供了一种直截了当的方法，当受信任的 AWS 服务代表 IAM 委托人执行额外操作（如 Amazon Athena）时，允许通过该服务直接访问。</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice">aws:ViaAWSService</a></td><td>此条件的作用与 aws:CalledVia 类似，但它并不局限于特定的 AWS 服务，而是可用于允许或拒绝访任何 AWS 服务。您通常不会在同一策略中使用 aws:CalledVia 和 aws:ViaAWSService；在针对特定 AWS 服务的策略中使用 aws:CalledVia，而在要允许/拒绝任何 AWS 服务时使用 aws:ViaAWSService。</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalisawsservice">aws:PrincipalIsAWSService</a></td><td>检查调用资源的是否是AWS 服务。比如AWS CloudTrail作为主体写入日志到Amazon S3存储桶。</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn">aws:PrincipalArn</a></td><td>此条件可以限制你指定的Amazon Resource Name (ARN)发起请求。比如某个IAM role：arn:aws:iam::123456789012:role/role-name</td><td></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalaccount">aws:PrincipalAccount</a></td><td>可用于限制某个指定账号的principal（角色或用户）的访问。示例中，除账号为 123456789012 的委托人外，其他人都被拒绝访问。</td><td><a data-footnote-ref href="#user-content-fn-4">查看示例</a></td></tr><tr><td><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount">aws:ResourceAccount</a></td><td>该条件用于限制访问属于特定账户的资源</td><td></td></tr></tbody></table>

[^1]: {\
    &#x20;   "Version": "2012-10-17",\
    &#x20;   "Statement": {\
    &#x20;       "Sid": "AllowCreateProductionCluster",\
    &#x20;       "Effect": "Allow",\
    &#x20;       "Action": \[\
    &#x20;           "redshift:CreateCluster",\
    &#x20;           "redshift:CreateTags"\
    &#x20;       ],\
    &#x20;       "Resource": "\*",\
    &#x20;       "Condition": {\
    &#x20;           "StringEquals": {\
    &#x20;               "aws:RequestTag/usage": "production"\
    &#x20;           }\
    &#x20;       }\
    &#x20;   }\
    }

[^2]: {\
    &#x20;   "Version": "2012-10-17",\
    &#x20;   "Statement": {\
    &#x20;       "Sid": "AllowModifyTestCluster",\
    &#x20;       "Effect": "Allow",\
    &#x20;       "Action": "redshift:ModifyCluster",\
    &#x20;       "Resource": "arn:aws:redshift:us-west-2:123456789012:cluster:\*",\
    &#x20;       "Condition": {\
    &#x20;           "StringEquals": {\
    &#x20;               "aws:ResourceTag/environment": "test"\
    &#x20;           }\
    &#x20;       }\
    &#x20;   }\
    }

[^3]: {\
    &#x20;   "Version": "2012-10-17",\
    &#x20;   "Statement": {\
    &#x20;       "Sid": "AllowCreateProductionCluster",\
    &#x20;       "Effect": "Allow",\
    &#x20;       "Action": \[\
    &#x20;           "redshift:CreateCluster",\
    &#x20;           "redshift:CreateTags"\
    &#x20;       ],\
    &#x20;       "Resource": "\*",\
    &#x20;       "Condition": {\
    &#x20;           "ForAllValues:StringEquals": {\
    &#x20;               "aws:TagKeys": \[\
    &#x20;                   "costcenter",\
    &#x20;                   "usage"\
    &#x20;               ]\
    &#x20;           }\
    &#x20;       }\
    &#x20;   }\
    }

[^4]: { "Version": "2012-10-17", "Statement": \[ { "Sid": "DenyAccessFromPrincipalNotInSpecificAccount", "Action": "service:\*", "Effect": "Deny", "Resource": \[ "arn:aws:service:region:accountID:resource" ], "Condition": { "StringNotEquals": { "aws:PrincipalAccount": \[ "123456789012" ] } } } ] }
