AWS IAMポリシーのCondition句のStringEqualsに複数条件を記載する

2022-12-05

参考 IAM JSON ポリシー要素: Condition - AWS Identity and Access Management

OR条件となるIAMポリシー

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxx:user/xxxx-s"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": ["xxxxxxx_SFCRole=2_JVxxxxxxO3Bd/Pr0=","xxxxxxx_SFCRole=2_dxxxxxxiw="]
                }
            }
        }
    ]
}

NGパターン

そもそも構文としてNG

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::xxxxxxx:user/xxxx-s"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "xxxxxxx_SFCRole=2_JVxxxxxxO3Bd/Pr0=",
                    "sts:ExternalId": "xxxxxxx_SFCRole=2_dxxxxxxiw="
                }
            }
        }
    ]
}

冗長なのでNG

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::xxxxxxx:user/xxxx-s"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"StringEquals": {
					"sts:ExternalId": "xxxxxxx_SFCRole=2_JVxxxxxxO3Bd/Pr0="
				}
			}
		},
		{
			"Effect": "Allow",
			"Principal": {
				"AWS": "arn:aws:iam::xxxxxxx:user/bkm20000-s"
			},
			"Action": "sts:AssumeRole",
			"Condition": {
				"StringEquals": {
					"sts:ExternalId": "xxxxxxx_SFCRole=2_dxxxxxxiw="
				}
			}
		}
	]
}

---

関連しているかもしれない記事

#AWS