Wildcard is not working in condition for principal in AWS IAM Trust Policy

Viewed 1054

I have a trust policy:

{
  "Effect": "Allow",
  "Principal": {
    "AWS": "*"
  },
  "Action": [
    "sts:AssumeRole",
    "sts:TagSession"
  ],
  "Condition": {
    "ForAnyValue:StringLike": {
      "aws:PrincipalArn": [
        "arn:aws:sts::AccountId:assumed-role/..",
        "arn:aws:sts::AccountId:assumed-role/..another_one_*"
      ]
    }
  }
}

But with this condition, it says that "arn:aws:sts::AccountId:assumed-role/..another_one_*" is not authorized to use sts:TagSession. When I remove the condition it works correctly, so don't understand if my condition is not correct?

0 Answers
Related