View a markdown version of this page

IAM policy validation check reference - AWS Identity and Access Management
Error – ARN account not allowedError – ARN Region not allowedError – Data type mismatchError – Duplicate keys with different caseError – Invalid actionError – Invalid ARN accountError – Invalid ARN prefixError – Invalid ARN RegionError – Invalid ARN resourceError – Invalid ARN service caseError – Invalid condition data typeError – Invalid condition key formatError – Invalid condition multiple BooleanError – Invalid condition operatorError – Invalid effectError – Invalid global condition keyError – Invalid partitionError – Invalid policy elementError – Invalid principal formatError – Invalid principal keyError – Invalid RegionError – Invalid serviceError – Invalid service condition keyError – Invalid service in actionError – Invalid variable for operatorError – Invalid versionError – Json syntax errorError – Json syntax errorError – Missing actionError – Missing ARN fieldError – Missing ARN RegionError – Missing effectError – Missing principalError – Missing qualifierError – Missing resourceError – Missing statementError – Null with if existsError – SCP syntax error action wildcardError – SCP syntax error principalError – Unique Sids requiredError – Unsupported action in policyError – Unsupported element combinationError – Unsupported global condition keyError – Unsupported principalError – Unsupported resource ARN in policyError – Unsupported SidError – Unsupported wildcard in principalError – Missing brace in variableError – Missing quote in variableError – Unsupported space in variableError – Empty variableError – Variable unsupported in elementError – Variable unsupported in versionError – Private IP addressError – Private NotIpAddressError – Policy size exceeds SCP quotaError – Invalid service principal formatError – Missing tag key in conditionError – Invalid vpc formatError – Invalid vpce formatError – Federated principal not supportedError – Unsupported action for condition keyError – Unsupported action in policyError – Unsupported resource ARN in policyError – Unsupported condition key for service principalError – Role trust policy syntax error notprincipalError – Role trust policy unsupported wildcard in principalError – Role trust policy syntax error resourceError – Type mismatch IP rangeError – Missing action for condition keyError – Invalid federated principal syntax in role trust policyError – Mismatched action for principalError – Missing action for roles anywhere trust policyError – Policy size exceeds RCP quotaError – RCP syntax error principalError – RCP syntax error allowError – RCP syntax error NotActionError – RCP syntax error actionError – Missing ARN accountError – Invalid kms key valueError – Variable usage too permissiveError – Wildcard usage too permissiveGeneral Warning – Create SLR with NotResourceGeneral Warning – Create SLR with star in action and NotResourceGeneral Warning – Create SLR with NotAction and NotResourceGeneral Warning – Create SLR with star in resourceGeneral Warning – Create SLR with star in action and resourceGeneral Warning – Create SLR with star in resource and NotActionGeneral Warning – Deprecated global condition keyGeneral Warning – Invalid date valueGeneral Warning – Invalid role referenceGeneral Warning – Invalid user referenceGeneral Warning – Missing versionGeneral Warning – Unique Sids recommendedGeneral Warning – Wildcard without like operatorGeneral Warning – Policy size exceeds identity policy quotaGeneral Warning – Policy size exceeds resource policy quotaGeneral Warning – Type mismatchGeneral Warning – Type mismatch BooleanGeneral Warning – Type mismatch dateGeneral Warning – Type mismatch numberGeneral Warning – Type mismatch stringGeneral Warning – Specific github repo and branch recommendedGeneral Warning – Policy size exceeds role trust policy quotaGeneral Warning – RCP missing related principal condition keyGeneral Warning – RCP missing related service principal condition keyGeneral Warning – RCP missing service condition key null checkGeneral Warning – Use condition key only with supported servicesSecurity Warning – Untrustworthy condition keySecurity Warning – Allow with NotPrincipalSecurity Warning – ForAllValues with single valued keySecurity Warning – Pass role with NotResourceSecurity Warning – Pass role with star in action and NotResourceSecurity Warning – Pass role with NotAction and NotResourceSecurity Warning – Pass role with star in resourceSecurity Warning – Pass role with star in action and resourceSecurity Warning – Pass role with star in resource and NotActionSecurity Warning – Missing paired condition keysSecurity Warning – Deny with unsupported tag condition key for serviceSecurity Warning – Deny NotAction with unsupported tag condition key for serviceSecurity Warning – Restrict access to service principalSecurity Warning – Missing condition key for oidc principalSecurity Warning – Missing github repo condition keySecurity Warning – String like operator with ARN condition keysSecurity Warning – DynamoDB attributes without selectSecurity Warning – S3 prefix in negative contextSecurity Warning – ForAnyValue with audience claim typeSuggestion – Empty array actionSuggestion – Empty array conditionSuggestion – Empty array condition ForAllValuesSuggestion – Empty array condition ForAnyValueSuggestion – Empty array condition IfExistsSuggestion – Empty array principalSuggestion – Empty array resourceSuggestion – Empty object conditionSuggestion – Empty object principalSuggestion – Empty Sid valueSuggestion – Equivalent to null falseSuggestion – Equivalent to null trueSuggestion – Improve IP rangeSuggestion – Null with qualifierSuggestion – Private IP address subsetSuggestion – Private NotIpAddress subsetSuggestion – Redundant actionSuggestion – Redundant condition value numSuggestion – Redundant resourceSuggestion – Redundant statementSuggestion – Wildcard in service nameSuggestion – Allow with unsupported tag condition key for serviceSuggestion – Allow NotAction with unsupported tag condition key for serviceSuggestion – Recommended condition key for service principalSuggestion – Irrelevant condition key in policySuggestion – Redundant key due to wildcard in conditionSuggestion – Redundant principal in role trust policySuggestion – Redundant statement due to wildcard in conditionSuggestion – Confirm audience claim type

IAM policy validation check reference

You can validate your policies using AWS Identity and Access Management Access Analyzer policy validation. You can create or edit a policy using the AWS CLI, AWS API, or JSON policy editor in the IAM console. IAM Access Analyzer validates your policy against IAM policy grammar and AWS best practices. You can view policy validation check findings that include security warnings, errors, general warnings, and suggestions for your policy. These findings provide actionable recommendations that help you author policies that are functional and conform to security best practices. The list of basic policy checks provided by IAM Access Analyzer are shared below. There is no additional charge associated with running the policy validation checks. To learn more about validating policies using policy validation, see Validate policies with IAM Access Analyzer.

Error – ARN account not allowed

Issue code: ARN_ACCOUNT_NOT_ALLOWED

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

ARN account not allowed: The service {{service}} does not support specifying an account ID in the resource ARN.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The service {{service}} does not support specifying an account ID in the resource ARN."

Resolving the error

Remove the account ID from the resource ARN. The resource ARNs for some AWS services do not support specifying an account ID.

For example, Amazon S3 does not support an account ID as a namespace in bucket ARNs. An Amazon S3 bucket name is globally unique, and the namespace is shared by all AWS accounts. To view all of the resource types available in Amazon S3, see Resource types defined by Amazon S3 in the Service Authorization Reference.

Related terms

Error – ARN Region not allowed

Issue code: ARN_REGION_NOT_ALLOWED

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

ARN Region not allowed: The service {{service}} does not support specifying a Region in the resource ARN.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The service {{service}} does not support specifying a Region in the resource ARN."

Resolving the error

Remove the Region from the resource ARN. The resource ARNs for some AWS services do not support specifying a Region.

For example, IAM is a global service. The Region portion of an IAM resource ARN is always kept blank. IAM resources are global, like an AWS account is today. For example, after you sign in as an IAM user, you can access AWS services in any geographic region.

Error – Data type mismatch

Issue code: DATA_TYPE_MISMATCH

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Data type mismatch: The text does not match the expected JSON data type {{data_type}}.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The text does not match the expected JSON data type {{data_type}}."

Resolving the error

Update the text to use the supported data type.

For example, the Version global condition key requires a String data type. If you provide a date or an integer, the data type won't match.

Related terms

Error – Duplicate keys with different case

Issue code: DUPLICATE_KEYS_WITH_DIFFERENT_CASE

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Duplicate keys with different case: The condition key {{key}} appears more than once with different capitalization in the same condition block. Remove the duplicate condition keys.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition key {{key}} appears more than once with different capitalization in the same condition block. Remove the duplicate condition keys."

Resolving the error

Review the similar condition keys within the same condition block and use the same capitalization for all instances.

A condition block is the text within the Condition element of a policy statement. Condition key names are not case-sensitive. The case-sensitivity of condition key values depends on the condition operator that you use. For more information about case-sensitivity in condition keys, see IAM JSON policy elements: Condition.

Related terms

Error – Invalid action

Issue code: INVALID_ACTION

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid action: The action {{action}} does not exist. Did you mean {{valid_action}}?

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The action {{action}} does not exist. Did you mean {{valid_action}}?"

Resolving the error

The action that you specified is not valid. This can happen if you mis-type the service prefix or the action name. For some common issues, the policy check returns a suggested action.

Related terms

AWS managed policies with this error

AWS managed policies enable you to get started with AWS by assigning permissions based on general AWS use cases.

The following AWS managed policies include invalid actions in their policy statements. Invalid actions do not affect the permissions granted by the policy. When using an AWS managed policy as a reference to create your managed policy, AWS recommends that you remove invalid actions from your policy.

Error – Invalid ARN account

Issue code: INVALID_ARN_ACCOUNT

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid ARN account: The resource ARN account ID {{account}} is not valid. Provide a 12-digit account ID.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The resource ARN account ID {{account}} is not valid. Provide a 12-digit account ID."

Resolving the error

Update the account ID in the resource ARN. Account IDs are 12-digit integers. To learn how to view your account ID, see Finding your AWS account ID.

Related terms

Error – Invalid ARN prefix

Issue code: INVALID_ARN_PREFIX

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid ARN prefix: Add the required prefix (arn) to the resource ARN.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "Add the required prefix (arn) to the resource ARN."

Resolving the error

AWS resource ARNs must include the required arn: prefix.

Related terms

Error – Invalid ARN Region

Issue code: INVALID_ARN_REGION

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid ARN Region: The Region {{region}} is not valid for this resource. Update the resource ARN to include a supported Region.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The Region {{region}} is not valid for this resource. Update the resource ARN to include a supported Region."

Resolving the error

The resource type is not supported in the specified Region. For a table of AWS services supported in each Region, see the Region table.

Related terms

Error – Invalid ARN resource

Issue code: INVALID_ARN_RESOURCE

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid ARN resource: Resource ARN does not match the expected ARN format. Update the resource portion of the ARN.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "Resource ARN does not match the expected ARN format. Update the resource portion of the ARN."

Resolving the error

The resource ARN must match the specifications for known resource types. To view the expected ARN format for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view its resource types and ARN formats.

Related terms

Error – Invalid ARN service case

Issue code: INVALID_ARN_SERVICE_CASE

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid ARN service case: Update the service name {{service}} in the resource ARN to use all lowercase letters.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "Update the service name {{service}} in the resource ARN to use all lowercase letters."

Resolving the error

The service in the resource ARN must match the specifications (including capitalization) for service prefixes. To view the prefix for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service and locate its prefix in the first sentence.

Related terms

Error – Invalid condition data type

Issue code: INVALID_CONDITION_DATA_TYPE

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid condition data type: The condition value data types do not match. Use condition values of the same JSON data type.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition value data types do not match. Use condition values of the same JSON data type."

Resolving the error

The value in the condition key-value pair must match the data type of the condition key and condition operator. To view the condition key data type for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service.

For example, the CurrentTime global condition key supports the Date condition operator. If you provide a string or an integer for the value in the condition block, the data type won't match.

Related terms

Error – Invalid condition key format

Issue code: INVALID_CONDITION_KEY_FORMAT

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid condition key format: The condition key format is not valid. Use the format service:keyname.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition key format is not valid. Use the format service:keyname."

Resolving the error

The key in the condition key-value pair must match the specifications for the service. To view the condition keys for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service.

Related terms

Error – Invalid condition multiple Boolean

Issue code: INVALID_CONDITION_MULTIPLE_BOOLEAN

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid condition multiple Boolean: The condition key does not support multiple Boolean values. Use a single Boolean value.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition key does not support multiple Boolean values. Use a single Boolean value."

Resolving the error

The key in the condition key-value pair expects a single Boolean value. When you provide multiple Boolean values, the condition match might not return the results that you expect.

To view the condition keys for a service, see Actions, resources, and condition keys for AWS services. Choose the name of the service to view the condition keys for that service.

Error – Invalid condition operator

Issue code: INVALID_CONDITION_OPERATOR

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid condition operator: The condition operator {{operator}} is not valid. Use a valid condition operator.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition operator {{operator}} is not valid. Use a valid condition operator."

Resolving the error

Update the condition to use a supported condition operator.

Related terms

Error – Invalid effect

Issue code: INVALID_EFFECT

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid effect: The effect {{effect}} is not valid. Use Allow or Deny.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The effect {{effect}} is not valid. Use Allow or Deny."

Resolving the error

Update the Effect element to use a valid effect. Valid values for Effect are Allow and Deny.

Related terms

Error – Invalid global condition key

Issue code: INVALID_GLOBAL_CONDITION_KEY

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid global condition key: The condition key {{key}} does not exist. Use a valid condition key.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The condition key {{key}} does not exist. Use a valid condition key."

Resolving the error

Update the condition key in the condition key-value pair to use a supported global condition key.

Global condition keys are condition keys with an aws: prefix. AWS services can support global condition keys or provide service-specific keys that include their service prefix. For example, IAM condition keys include the iam: prefix. For more information, see  Actions, Resources, and Condition Keys for AWS Services  and choose the service whose keys you want to view.

Related terms

Error – Invalid partition

Issue code: INVALID_PARTITION

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid partition: The resource ARN for the service {{service}} does not support the partition {{partition}}. Use the supported values: {{partitions}}

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The resource ARN for the service {{service}} does not support the partition {{partition}}. Use the supported values: {{partitions}}"

Resolving the error

Update the resource ARN to include a supported partition. If you included a supported partition, then the service or resource might not support the partition that you included.

A partition is a group of AWS Regions. Each AWS account is scoped to one partition. In Classic Regions, use the aws partition. In China Regions, use aws-cn.

Related terms

Error – Invalid policy element

Issue code: INVALID_POLICY_ELEMENT

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid policy element: The policy element {{element}} is not valid.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The policy element {{element}} is not valid."

Resolving the error

Update the policy to include only supported JSON policy elements.

Related terms

Error – Invalid principal format

Issue code: INVALID_PRINCIPAL_FORMAT

Finding type: ERROR

Finding details

In the AWS Management Console, the finding for this check includes the following message:

Invalid principal format: The Principal element contents are not valid. Specify a key-value pair in the Principal element.

In programmatic calls to the AWS CLI or AWS API, the finding for this check includes the following message:

"findingDetails": "The Principal element contents are not valid. Specify a key-value pair in the Principal element."

Resolving the error

Update the principal to use a supported key-value pair format.

You can specify a principal in a resource-based policy, but not an identity-based policy.

For example, to define access for everyone in an AWS account, use the following principal in your policy:

"Principal": { "AWS": "123456789012" }

Related terms

Error – Invalid principal key