SCP Syntax

Policy Structure

A policy consists of a version and a single statement or an array of individual statements, each indicating a different action.

Figure 1 Policy structure

Policy Elements

The following table describes the policy elements (Version and Statement).

The following elements are not supported in SCPs:

• Principal
• NotPrincipal
• NotResource

Condition Keys

• Multivalued condition keys
  1. ForAllValues: Tests whether the value of every member of the request set is a subset of the condition key set. The condition returns true if every key value in the request matches at least one value in the policy.
  2. ForAnyValue: Tests whether at least one member of the set of request values matches at least one member of the set of condition key values. The condition returns true if any one of the key values in the request matches any one of the condition values in the policy. The condition returns false if there are no matching keys in the request, or if the key value resolves to an empty data set.
     Condition Operators

     Figure 2 Condition operators
     

     1. If a single condition operator includes multiple values for one key, that condition operator is evaluated using a logical OR. The condition returns true if any one of the key values in the request matches any one of the condition values in the policy.
        

        For condition operators that contain Not (such as StringNotEquals), the request value cannot match any of the condition values.

     2. The AND operation is used between different condition keys of the same operator. It is also used between different operators.

Operators

A condition operator, a condition key, and a condition value together constitute a complete condition statement. A policy can be applied only when its request conditions are met. The operator suffix IfExists indicates that a policy is applied if a request value is empty or meets the specified condition. For example, if the operator StringEqualsIfExists is selected for a policy, the policy is applied if a request value is empty or equal to the specified condition value. Operators are string operators. They are not case-sensitive unless otherwise specified.

• String

  Table 3 String condition operators

  Type	Operator	Description
  String	StringEquals	Exact matching, case sensitive
  	StringNotEquals	Negated matching, case sensitive
  	StringEqualsIgnoreCase	Exact matching, ignoring case
  	StringNotEqualsIgnoreCase	Negated matching, ignoring case
  	StringMatch	Case-sensitive matching. The values can include multi-character match wildcards (*) and single-character match wildcards (?) anywhere in the string.
  	StringNotMatch	Negated case-sensitive matching. The values can include multi-character match wildcards (*) and single-character match wildcards (?) anywhere in the string.

• Numeric

  Table 4 Numeric condition operators

  Type	Operator	Description
  Numeric	NumberEquals	Matching
  	NumberNotEquals	Negated matching
  	NumberLessThan	"Less than" matching
  	NumberLessThanEquals	"Less than or equals" matching
  	NumberGreaterThan	"Greater than" matching
  	NumberGreaterThanEquals	"Greater than or equals" matching

• Date

  Table 5 Date condition operators

  Type	Operator	Description
  Date	DateLessThan	Matching before a specific date and time
  	DateLessThanEquals	Matching at or before a specific date and time
  	DateGreaterThan	Matching after a specific date and time
  	DateGreaterThanEquals	Matching at or after a specific date and time

• Boolean

  Table 6 Boolean condition operators

  Type	Operator	Description
  Bool	Bool	Boolean conditions let you construct condition elements that restrict access based on comparing a key to "true" or "false."

• Null

  Table 7 Null condition operators

  Type	Operator	Description
  Null	Null	You can use a Null condition operator to check if a condition key is absent at the time of authorization. In the policy statement, you can use either "true" (the key does not exist or is null) or "false" (the key exists and its value is not null).

• IP

  Table 8 IP condition operators

  Type	Operator	Description
  IP	IpAddress	IP address or IP address range
  	NotIpAddress	All IP addresses beyond a specific IP address or IP address range

• IfExists operator suffix

  You can add "IfExists" to the end of any condition operator name except the "Null condition", for example, StringEqualsIfExists. If the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, evaluate the condition element as true.