AWS StringLike or condtion for UserAgent

Question

We have a policy for our S3 bucket with StringLike condition. We allow requests from users who have 'Home' in their request and currently the policy works well. But we want to add or condition to the policy and we want to accept 'House' value as well. So, we will accept requests with either of them in single policy. Both words are not mandatory, one is enough for us.

We have tried to add;

*Home*,*House* but it did not work. How to achieve that? Currently we have the policy below:

{
    "Version": "2011-11-15",
    "Id": "Policy150267299",
    "Statement": [
        {
            "Sid": "Stmt102603643",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::someurl/*",
            "Condition": {
                "StringLike": {
                    "aws:UserAgent": "*Home*"
                }
            }
        }
    ]
}

score 1 · Answer 1 · answered May 03 '22 at 05:23

According to IAM doc about evaluation logic, you can have multiple values for a condition key:

If a single condition operator includes multiple values for one key, that condition operator is evaluated using a logical OR.

In your case, the policy becomes:

{
    "Version": "2011-11-15",
    "Id": "Policy150267299",
    "Statement": [
        {
            "Sid": "Stmt102603643",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::someurl/*",
            "Condition": {
                "StringLike": {
                    "aws:UserAgent": ["*Home*", "*House*"]
                }
            }
        }
    ]
}

AWS StringLike or condtion for UserAgent

1 Answers1