Closed david-perez closed 4 months ago
From the specification on deriving condition keys:
A resource's condition keys include those that are inferred from their identifiers, including the resource's ancestors, and those applied via the aws.iam#conditionKeys trait trait. Condition keys for resource identifiers are automatically inferred unless explicitly configured not to via the aws.iam#disableConditionKeyInference trait trait.
Isn't deriving a condition key from a resource id superfluous? It's a condition key whose value is identical to the value of the resource id in the request. Why not use the resource id directly then?
Yes, it is. This functionality has been in place for quite some time, however, so we adjusted aws.iam#disableConditionKeyInference
to be applicable at the service level.
Consider this model where we forgot to define the
pokemon-service:RegistrationDate
IAM service condition key:The error message reads:
But
pokemon-species:PokemonSpeciesName
is not a condition key. This set seems to be containing resource IDs too.