# 允许AWS服务访问 aws:PrincipalIsAWSService

`aws:PrincipalIsAWSService: null` 这种情况会在AWS IAM策略评估期间出现，表示请求的发出者**不是**一个AWS服务。 换句话说，请求并非来自AWS内部的服务，而是来自外部的实体，例如：

* **IAM用户:** 直接登录AWS控制台或使用AWS CLI的用户。
* **IAM角色:** 由IAM用户或其他AWS服务所承担的角色。
* **Federated用户:** 通过诸如SAML或OIDC之类的联合身份提供商进行身份验证的用户。

#### Bool in an <mark style="color:green;">Allow</mark> Statement

<table data-header-hidden data-full-width="true"><thead><tr><th width="295"></th><th></th><th></th></tr></thead><tbody><tr><td>Policy Condition</td><td>Request Context</td><td>Result</td></tr><tr><td><pre data-overflow="wrap"><code>"Bool": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: null</code></td><td><img src="https://iam.cloudcopilot.io/_astro/unknown.4jslFilM_ZFyvUV.svg" alt="Not Allowed"> Not AllowedStatement does not apply</td></tr><tr><td><pre data-overflow="wrap"><code>"Bool": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: true</code></td><td><img src="https://iam.cloudcopilot.io/_astro/allow.BKwnWDMp_Z2m9B7U.svg" alt="Allowed"> AllowedAssuming no explicit Deny elsewhere</td></tr><tr><td><pre data-overflow="wrap"><code>"Bool": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: false</code></td><td><img src="https://iam.cloudcopilot.io/_astro/unknown.4jslFilM_ZFyvUV.svg" alt="Not Allowed"> Not AllowedStatement does not apply</td></tr></tbody></table>

BoolIfExists in an <mark style="color:green;">Allow</mark> Statement

<table data-header-hidden><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>Policy Condition</td><td>Request Context</td><td>Result</td></tr><tr><td><pre data-overflow="wrap"><code>"BoolIfExists": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: null</code></td><td><img src="https://iam.cloudcopilot.io/_astro/allow.BKwnWDMp_Z2m9B7U.svg" alt="Allowed"> AllowedAssuming no explicit Deny elsewhere</td></tr><tr><td><pre data-overflow="wrap"><code>"BoolIfExists": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: true</code></td><td><img src="https://iam.cloudcopilot.io/_astro/allow.BKwnWDMp_Z2m9B7U.svg" alt="Allowed"> AllowedAssuming no explicit Deny elsewhere</td></tr><tr><td><pre data-overflow="wrap"><code>"BoolIfExists": {
  "aws:PrincipalIsAWSService": "true"
}
</code></pre></td><td><code>aws:PrincipalIsAWSService: false</code></td><td><img src="https://iam.cloudcopilot.io/_astro/unknown.4jslFilM_ZFyvUV.svg" alt="Not Allowed"> Not AllowedStatement does not apply</td></tr></tbody></table>