DOC: Create new IAM Policy Grammar Page#799
Open
blkgrlcto wants to merge 11 commits into
Open
Conversation
…soft Entra ID (#722) Co-authored-by: Brian Rinaldi <brian.rinaldi@gmail.com>
…nedPollerConfig, FunctionResponseTypes) (#750) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…th Microsoft Entra ID" (#775)
Add a reference page listing the condition operators and condition keys the LocalStack IAM policy engine evaluates. Covers the newly supported numeric operators, negated string operators, and negated ARN operators, plus the iam:PolicyArn and s3:max-keys condition keys, with a worked s3:max-keys example. Operators whose support is not yet confirmed are marked as pending a check against the policy engine.
blkgrlcto
requested review from
HarshCasper,
quetzalliwrites and
remotesynth
as code owners
July 20, 2026 12:23
| order: 5 | ||
| --- | ||
|
|
||
| <!-- |
Collaborator
There was a problem hiding this comment.
hey @blkgrlcto there are several notes here mentioning this being in draft mode. Also several parts where it says TO DO. Is this ready to review or should we move this PR to draft mode?
quetzalliwrites
requested review from
dfangl,
joe4dev,
nik-localstack and
pinzon
as code owners
July 22, 2026 11:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a new IAM Policy Grammar reference page under Security Testing,
documenting the condition operators and condition keys the LocalStack IAM
policy engine can evaluate. The same engine backs IAM Policy Enforcement
and the IAM Policy Simulator, so the page applies to both.
New page:
src/content/docs/aws/capabilities/security-testing/iam-policy-grammar.mdDocuments: localstack-pro#7232, localstack-pro#7209
Closes: DOC-276, DOC-277
Contents
Confirmed as supported: the six numeric operators, the negated string
operators (
StringNotEquals,StringNotEqualsIgnoreCase,StringNotLike),and the negated ARN operators (
ArnNotEquals,ArnNotLike).iam:PolicyArnands3:max-keys.s3:max-keysnumeric guardrail.Draft — blockers before this can merge
Verifyin the String and ARNtables (
StringEquals,StringEqualsIgnoreCase,StringLike,ArnEquals,ArnLike) and the entire "Other categories" set (Date, Bool, BinaryEquals,IpAddress/NotIpAddress, Null, the
...IfExistsvariants, andForAllValues/ForAnyValue) need confirming against the policy engine. The
release notes only tell us what was added, not the complete supported set.
tagstier andsidebar.orderrelative to theother Security Testing pages.
s3:max-keysexample end-to-end underENFORCE_IAM=1.Reviewer notes
DRAFTheader andVERIFYmarkers) must beremoved before merge.
(tracked separately as DOC-302). Either land that first or drop the two links
to it until it exists.
Out of scope
separate ticket and intentionally not documented here.