jwt:groups condition values in IAM policies?

[rvIceBreaker]

jwt:groups condition values in IAM policies?

[rvIceBreaker]

So it appears that I'm slightly incorrect, ${jwt:groups} does substitute the variable, but only with the first element when its an array of values; at least in terms of what my policy and requests authorize in testing.

...
{
    "Effect": "Allow",
    "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:PutObject"
    ],
    "Resource": [
        "arn:aws:s3:::testbucket1/${jwt:groups}",
        "arn:aws:s3:::testbucket1/${jwt:groups}/*"
    ]
}
...

There doesn't seem to be any way to index them individually.

[harshavardhana]

Right now, we need cycles to take this up @rvIceBreaker. I suggest pushing our roadmaps by becoming a customer if you have a production requirement.

However, this is not a priority and will be addressed later if and when we find some time.

[harshavardhana]

You can use jwt:groups as part of the ForAnyValue or ForAllValues conditionals. However, these are not supported in the resources and will only use the first element.

https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-logic-multiple-context-keys-or-values.html

[rvIceBreaker]

@harshavardhana I appreciate the response, this information isn't really clearly stated anywhere so hopefully this thread can save someone else some time.

As far as I can tell using ForAnyValues/ForAllValues on s3:ListBucket->s3:prefix also only matches against the first element.

//s3:ListBucket statement
"Condition": {
    "ForAllValues:StringLike": {
        "s3:prefix": [
            "${jwt:groups}",
            "${jwt:groups}/*"
        ]
    }
}
//s3:GetObject statement
"Resource": [
    "arn:aws:s3:::testbucket1/*"
]

In my testing, the above effectively only allows listing from the first element in ${jwt:groups}, though I can GetObject on a known object path that differs.