From 735579baaae4d7c5760aa23fe36e467612ae26b5 Mon Sep 17 00:00:00 2001 From: Quetzalli Date: Thu, 23 Jul 2026 16:05:51 +0200 Subject: [PATCH 1/2] DOC-315: Document RAM ram:RequestedAllowsExternalPrincipals condition key Add an IAM Condition Keys section to the RAM docs, mirroring the existing EC2 pattern, covering the new condition key that gates CreateResourceShare/UpdateResourceShare based on allowExternalPrincipals. --- src/content/docs/aws/services/ram.mdx | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/src/content/docs/aws/services/ram.mdx b/src/content/docs/aws/services/ram.mdx index 79eaadbb0..eff34da89 100644 --- a/src/content/docs/aws/services/ram.mdx +++ b/src/content/docs/aws/services/ram.mdx @@ -44,6 +44,25 @@ No IAM policies are created or attached, and no permission enforcement takes pla For all other resource types, the functionality is limited to mocking. +## IAM Condition Keys + +When [IAM Policy Enforcement](/aws/developer-tools/security-testing/iam-policy-enforcement/) is enabled, LocalStack supports the following RAM-specific condition key, matching the behavior described in the [AWS condition keys reference](https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsresourceaccessmanager.html#awsresourceaccessmanager-policy-keys): + +- `ram:RequestedAllowsExternalPrincipals` — the `allowExternalPrincipals` value of a `CreateResourceShare` or `UpdateResourceShare` request, useful for restricting resource shares to principals within your organization. + +For example, the following policy statement only allows creating or updating a resource share when it does not allow external principals: + +```json +{ + "Effect": "Allow", + "Action": ["ram:CreateResourceShare", "ram:UpdateResourceShare"], + "Resource": "*", + "Condition": { + "Bool": { "ram:RequestedAllowsExternalPrincipals": "false" } + } +} +``` + ## API Coverage From f79c609eb64f193236cf886b67d8dada8d85b198 Mon Sep 17 00:00:00 2001 From: Quetzalli Date: Thu, 30 Jul 2026 13:12:36 +0200 Subject: [PATCH 2/2] DOC-315: Cross-link service-specific IAM condition keys Add a "Service-Specific Condition Keys" section to the IAM Coverage page linking out to the EC2 and RAM service docs, and link the existing global condition keys to AWS's reference page. Addresses review feedback from Viren on PR #812. --- .../aws/developer-tools/security-testing/iam-coverage.md | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/content/docs/aws/developer-tools/security-testing/iam-coverage.md b/src/content/docs/aws/developer-tools/security-testing/iam-coverage.md index 6da101568..dc1324c22 100644 --- a/src/content/docs/aws/developer-tools/security-testing/iam-coverage.md +++ b/src/content/docs/aws/developer-tools/security-testing/iam-coverage.md @@ -152,7 +152,7 @@ It only includes operations performed with a principal, not as root, so test set | | - StringEqualsIgnoreCase | | | - StringLike | | | - ArnLike/ArnEquals | -| | Supported condition keys: | +| | Supported [global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html): | | | - aws:RequestedRegion | | | - aws:PrincipalArn | | | - aws:SourceArn | @@ -161,6 +161,12 @@ It only includes operations performed with a principal, not as root, so test set | | - aws:RequestTag | | | - aws:PrincipalTag | +## Service-Specific Condition Keys + +In addition to the global condition keys above, some services support their own condition keys, matching AWS's [per-service condition key reference](https://docs.aws.amazon.com/service-authorization/latest/reference/reference_policies_actions-resources-contextkeys.html): + +- [EC2](/aws/services/ec2/#iam-condition-keys): `ec2:MetadataHttpTokens`, `ec2:Attribute/` +- [RAM](/aws/services/ram/#iam-condition-keys): `ram:RequestedAllowsExternalPrincipals` ## Current Limitations