AWS IAM: wildcards in conditions for aws:principalArn

Viewed 45

I want to make my IAM policy conditional, to allow it to work with an EC2 instance that has definite assumed role. The following syntax works great if I know the id of that instance, sasying it's i-1111111111111111:

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Effect" : "Allow",
    "Principal" : {
        "AWS": "arn:aws:sts::111122223333:assumed-role/MyRole/i-1111111111111111"
      },
    "Action" : "secretsmanager:GetSecretValue",
    "Resource" : "*"
  } ]
}

However I want to allow this access for any future EC2 instance with the same role. As wildcards do not work in Principal field, I try to specify a wildcarded condition:

    "Principal" : "*",
    "Condition": {
      "StringLike": {
        "aws:PrincipalArn": "arn:aws:sts::111122223333:assumed-role/MyRole/*"
      }
    },

but this does not grant access.

What the correct syntax should be for wildcarded principal?

0 Answers
Related