5 IAM Condition Keys That Prevent the Mistakes Wildcards Create

5 IAM Condition Keys That Prevent the Mistakes Wildcards Create

An IAM policy with Action: "s3:*" and Resource: "*" is an obvious problem. You can spot it from across the room.

The harder problems are the policies that look reasonable. Action: "s3:GetObject" on Resource: "*" — that's just one action, right? But it means the role can read objects from every S3 bucket in the account, including the one where CloudTrail logs land and the one the billing team uses for customer invoices.

Condition keys are how you write policies that are broad where they need to be and tight everywhere else. They add a second dimension to every permission statement: not just what this role can do, but under what circumstances it can do it.

Here are five condition keys that catch the most common IAM overpermission patterns.