3

I have a trust policy:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "*"
  },
  "Action": [
    "sts:AssumeRole",
    "sts:TagSession"
  ],
  "Condition": {
    "ForAnyValue:StringLike": {
      "aws:PrincipalArn": [
        "arn:aws:sts::AccountId:assumed-role/..",
        "arn:aws:sts::AccountId:assumed-role/..another_one_*"
      ]
    }
  }
}

But with this condition, it says that "arn:aws:sts::AccountId:assumed-role/..another_one_*" is not authorized to use sts:TagSession. When I remove the condition it works correctly, so don't understand if my condition is not correct?

Abdullah Khawer
  • 4,461
  • 4
  • 29
  • 66
Dina Nasyrkhan
  • 51
  • 8
  • 1
    I tried your example and for me it is actually working, there seems to be no problem with the wildcard. My assumed role gets access to sts:TagSession. I noticed however, that it takes some time for the policy change to take effect, and during the first tries the ```aws cli``` switched back and forth between access denied and access allowed before it went stable, for some reason... – eli6 Feb 08 '22 at 14:29
  • IAM propagation takes a little time. – jarmod Feb 08 '22 at 23:48

0 Answers0