IAM Conditions

Attribute-based access (ABAC) — Azure · AWS · GCP

Concept

IAM Conditions add context-aware rules to role bindings — "allow this role, but only when X is true." Useful for time-bound access, IP restrictions, and resource tags.

Condition Language
JSON (ABAC)
JSON (IAM Condition block)
CEL (Common Expression Language)
Time-Bound
Azure AD PIM (not IAM)
Activate for X hours
DateGreaterThan / DateLessThan
Native IAM condition
request.time CEL expression
Native IAM condition
IP Restriction
Conditional Access Policy
Named Locations
IpAddress condition
aws:SourceIp
origin.ip CEL condition
e.g. origin.ip in ['']
Resource Tag
@Resource[...] attribute
Limited to Storage currently
aws:ResourceTag
Full support
resource.matchTag()
Full support via CEL

IP-Based Restriction

○ Azure — Conditional Access

Not in IAM directly. Uses Entra Conditional Access with Named Locations for IP ranges.

○ AWS — IAM Condition Block

"Condition":{"IpAddress":{"aws:SourceIp":"203.0.113.0/24"}}

○ GCP — CEL Expression

--condition-expression="origin.ip in ['203.0.113.0/24']"

Time-Bound Access

○ Azure — Entra PIM

Azure AD Privileged Identity Management: eligible → activate for X hours. Not a native IAM condition on the role assignment.

○ AWS — Date Condition

"Condition":{"DateGreaterThan":{"aws:CurrentTime":"2026-01-01T00:00:00Z"},"DateLessThan":{"aws:CurrentTime":"2026-12-31T23:59:59Z"}}

○ GCP — CEL Time

--condition="request.time < timestamp('2026-12-31T23:59:59Z') && request.time > timestamp('2026-01-01T00:00:00Z')"

Resource Tag-Based Access

○ Azure — Azure ABAC

{"conditionVersion":"2.0","condition":"@Resource[storageAccounts/blobServices/containers:name] StringContains 'prod'"}

Currently limited to Storage Blob Data actions.

○ AWS — ResourceTag Key

"Condition":{"StringEquals":{"aws:ResourceTag/environment":"prod"}}

Works with all services that support resource tagging.

○ GCP — GCP Tags

--condition="resource.matchTag('ORG_ID/environment', 'prod')"

Requires tag created at org level first.