IEF Request Conditions

Request conditions are useful in determining when a custom policy takes effect. A request condition consists of a condition key and operator. Condition keys are either global or service-level and are used in the Condition element of a policy statement. Global condition keys (starting with g:) are available for operations of all services, while service-level condition keys (starting with a service name such as ief:) are available only for operations of a specific service. An operator is used together with a condition key to form a complete condition statement.

IEF has a group of predefined condition keys that can be used in IAM. For example, to define an "Allow" permission, you can use the condition key ief:AssumeUserName to filter matching requesters by username. The following table lists the predefined condition keys of IEF.

{
    "Version": "1.1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ief:deployment:create",
                "ief:appVersion:update",
                "ief:deployment:update",
                "ief:application:create"
            ],
            "Condition": {
                "StringEquals": {
                    "ief:AssumeUserName": [
                        "test"
                    ]
                }
            },
            "Resource": [
                "ief:*:*:deployment:*",
                "ief:*:*:appVersion:*",
                "ief:*:*:application:*"
            ]
        }
    ]
}