如何定义一个条件来验证 iam aws 策略中的至少一个键

Question

我检查了一个解决方案来定义一个策略，该策略只接受两个 IP 地址中的一个作为源 IP“或”一个源 VPC（私有 IP 地址池）-PSB

根据定义，相同条件的键之间有一个“AND” (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "11.11.11.11/32",
                        "22.22.22.22/32"
                    ]
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                },
                "StringNotEquals": {
                    "aws:SourceVpc": [
                        "vpc-00222222222222"
                    ]
                }
            }
        }
    ] 
}

谢谢

Answer 1

对于 OR，您必须复制您的陈述。我知道这是代码重复，它并不“漂亮”，但这就是它的完成方式（我不确定你想用你的 Bool 做什么）：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "11.11.11.11/32",
                        "22.22.22.22/32"
                    ]
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                }
            }
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
               "Bool": {
                    "aws:ViaAWSService": "false"
                },
                "StringNotEquals": {
                    "aws:SourceVpc": [
                        "vpc-00222222222222"
                    ]
                }
            }
        },

    ] 
}