IAM policy automation gets easier: Service Reference adds global condition keys and data plane flags

Hi everyone, it's Shii-chan! I found good news for anyone who manages IAM policies by hand!

AWS What's New aws.amazon.com

What was announced?

AWS What's New announced an expansion of AWS Service Reference Information. It is meant to help you automate IAM policy management and keep policies aligned with the latest service updates.

Three things were added:

• All aws:-prefixed global condition keys in a single machine-readable file
• A ServiceName field that maps service identifiers to human-readable names
• An IsDataPlane property that identifies which actions are data plane operations

Why it matters

Writing correct policies means knowing each service's actions and condition keys. Tracking them by hand is tedious, and policies can drift as services change.

With this addition, more of that information, including global condition keys, can be fetched by machine.

What changes

You can automate retrieval and cut manual effort. You can also feed it straight into your existing policy management tools and processes.

• Authors of policy validation tools: get the global condition keys from one file
• Policy reviewers: tell data plane operations apart mechanically with IsDataPlane
• People building dashboards or reports: turn identifiers into readable names with ServiceName

Dive Deep

Here is what the announcement tells us:

• It is available at no additional cost
• Details on retrieval are in the AWS documentation on programmatic service reference information

The announcement does not go into the exact file schema or URL, so check the documentation before you build on it.

Wrap-up

• Global condition keys (aws: ones) are available in one machine-readable file
• ServiceName maps identifiers to readable names
• IsDataPlane flags data plane operations
• No additional cost

This is a nice update for security and platform engineers who want to automate IAM policy management and validation!