[ {
  "Name" : "aws:AssumedRoot",
  "Description" : "Filters access based on whether the request was made using temporary security credentials for AssumeRoot",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:CalledVia",
  "Description" : "Filters access by the services that make the request on behalf of the IAM principal",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvia",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:CalledViaAWSMCP",
  "Description" : "Use this key to compare the services in the policy with the AWS MCP services that made requests on behalf of the IAM principal (user or role). When a principal makes a request to an AWS MCP service, that service uses the principal's credentials to make subsequent requests to other services. When the request is made using an AWS MCP service, this key is set with the value of the service principal. The aws:CalledViaAWSMCP key contains the service principal name of the MCP service that made requests on the principal's behalf.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledviaawsmcp",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:CalledViaFirst",
  "Description" : "Filters access by the first service that makes a chain of requests on behalf of the IAM principal",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledviafirst",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:CalledViaLast",
  "Description" : "Filters access by the last service that makes a chain of requests on behalf of the IAM principal",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-calledvialast",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:ChatbotSourceArn",
  "Description" : "This key identifies the chatbot configuration ARN associated with the assume role session initiated by AWS Chatbot.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-chatbotsourcearn",
  "Types" : [ "ARN", "String" ]
}, {
  "Name" : "aws:CurrentTime",
  "Description" : "Filters access by the time and date when the request was made",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-currenttime",
  "Types" : [ "Date" ]
}, {
  "Name" : "aws:Ec2InstanceSourcePrivateIPv4",
  "Description" : "This key identifies the private IPv4 address of the primary elastic network interface to which Amazon EC2 IAM role credentials were delivered. You must use this condition key with its companion key aws:Ec2InstanceSourceVpc to ensure that you have a globally unique combination of VPC ID and source private IP. Use this key with aws:Ec2InstanceSourceVpc to ensure that a request was made from the same private IP address that the credentials were delivered to.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-ec2instancesourceprivateip4",
  "Types" : [ "IpAddress" ]
}, {
  "Name" : "aws:Ec2InstanceSourceVpc",
  "Description" : "This key identifies the VPC to which Amazon EC2 IAM role credentials were delivered to. You can use this key in a policy with the aws:SourceVPC global key to check if a call is made from a VPC (aws:SourceVPC) that matches the VPC where a credential was delivered to (aws:Ec2InstanceSourceVpc).",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-ec2instancesourcevpc",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:EpochTime",
  "Description" : "Filters access by the time and date (in epoch or Unix time) when the request was made",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-epochtime",
  "Types" : [ "Numeric", "Date" ]
}, {
  "Name" : "aws:FederatedProvider",
  "Description" : "Filters access by the IdP that was used to authenticate the user",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-federatedprovider",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:IsMcpServiceAction",
  "Description" : "Filters access based on whether the action being authorized is an MCP service action. This is the MCP service action, not actions taken by the MCP service on your behalf",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-ismcpserviceaction",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:MultiFactorAuthAge",
  "Description" : "Filters access by how long ago (in seconds) the MFA-validated security credentials that made the request were issued",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthage",
  "Types" : [ "Numeric" ]
}, {
  "Name" : "aws:MultiFactorAuthPresent",
  "Description" : "Filters access if MFA was used to validate the temporary security credentials that made the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-multifactorauthpresent",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:PrincipalAccount",
  "Description" : "Filters request information into a request context",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalaccount",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:PrincipalArn",
  "Description" : "Filters actions based on the Amazon Resource Name (ARN) of the user or role that made the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalarn",
  "Types" : [ "ARN", "String" ]
}, {
  "Name" : "aws:PrincipalIsAWSService",
  "Description" : "Filters access based on whether the request source is made by an AWS service principal",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalisawsservice",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:PrincipalOrgID",
  "Description" : "Filters access by the identifier of an organization that you created using AWS Organizations",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgid",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:PrincipalOrgPaths",
  "Description" : "Filters actions based on the AWS Organizations path for the principal who is making the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalorgpaths",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:PrincipalServiceName",
  "Description" : "Filters access based on the AWS service principal name in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalservicename",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:PrincipalServiceNamesList",
  "Description" : "Filters access based on the AWS service principal names present in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principalservicenameslist",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:PrincipalTag/${TagKey}",
  "Description" : "Filters access by the tag key and value attached to the principal making the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltag",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:PrincipalType",
  "Description" : "Filters access by the the type of principal that made the request, such as the user, account, or federated user",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-principaltype",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:Referer",
  "Description" : "Filters access by who referred the client browser to the address where the request is being sent",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-referer",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:RequestTag/${TagKey}",
  "Description" : "Filters access by a tag's key and value in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag",
  "Types" : [ "String", "Numeric" ]
}, {
  "Name" : "aws:RequestedRegion",
  "Description" : "Filters access if a request is made to a specific region",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requestedregion",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:ResourceAccount",
  "Description" : "Filters access based on the AWS account ID of the resource in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceaccount",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:ResourceOrgID",
  "Description" : "Filters access based on the AWS organization ID of the resource in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgid",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:ResourceOrgPaths",
  "Description" : "Filters access based on the AWS organization path(s) of the resource in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourceorgpaths",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:ResourceTag/${TagKey}",
  "Description" : "Filters actions based on the presence of tag key-value pairs in the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:SecureTransport",
  "Description" : "Filters access if the request was sent using SSL",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-securetransport",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:SignInSessionArn",
  "Description" : "Filters access based on the ARN for Sign-In OAuth sessions",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-signinsessionarn",
  "Types" : [ "ARN", "String" ]
}, {
  "Name" : "aws:SourceAccount",
  "Description" : "Filters access if the request comes from a specific account ID",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceaccount",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:SourceArn",
  "Description" : "Filters access by the ARN of the source of the request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcearn",
  "Types" : [ "ARN", "String" ]
}, {
  "Name" : "aws:SourceIdentity",
  "Description" : "Filters actions based on the source identity that is set on the caller",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceidentity",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:SourceIp",
  "Description" : "Filters access by the requester's IP address",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip",
  "Types" : [ "IpAddress" ]
}, {
  "Name" : "aws:SourceOrgID",
  "Description" : "Filters access based on the AWS organization ID of the resource that triggered a service-to-service request.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceorgid",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:SourceOrgPaths",
  "Description" : "Filters access based on the AWS organization path of the resource that triggered a service-to-service request.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceorgpaths",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:SourceVpc",
  "Description" : "Filters access to a VPC based on its Identifier",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpc",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:SourceVpcArn",
  "Description" : "Filters access to a specific VPC based on its ARN",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpcarn",
  "Types" : [ "ARN" ]
}, {
  "Name" : "aws:SourceVpce",
  "Description" : "Filters access to a specific VPC endpoint",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourcevpce",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:TagKeys",
  "Description" : "Filters access by the tag keys in a request",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:TokenIssueTime",
  "Description" : "Filters access by the time and date when the temporary security credentials were issued",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tokenissuetime",
  "Types" : [ "Date" ]
}, {
  "Name" : "aws:UserAgent",
  "Description" : "Filters access by the requester's client application",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-useragent",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:ViaAWSMCPService",
  "Description" : "Use this key to check whether an AWS MCP service makes a request to another AWS service on your behalf using forward access sessions (FAS). The request context key returns true when an AWS MCP service forwards a request to an AWS service on behalf of the original IAM principal. The request context key also returns false when the principal makes the call directly.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsmcpservice",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:ViaAWSService",
  "Description" : "Filters access based on whether an AWS service makes the request on behalf of the IAM principal",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-viaawsservice",
  "Types" : [ "Bool" ]
}, {
  "Name" : "aws:VpcSourceIp",
  "Description" : "Filters access based on the IP address from which a request was made with the IP address specified in the policy",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpcsourceip",
  "Types" : [ "IpAddress" ]
}, {
  "Name" : "aws:VpceAccount",
  "Description" : "Filters access based on the AWS Account ID of the VPC endpoint through which the request was made.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpceaccount",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:VpceOrgID",
  "Description" : "Filters access based on the AWS organization ID of the VPC endpoint through which the request was made.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpceorgid",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:VpceOrgPaths",
  "Description" : "Filters access based on the AWS organization path(s) of the VPC endpoint through which the request was made.",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-vpceorgpaths",
  "Types" : [ "ArrayOfString" ]
}, {
  "Name" : "aws:userid",
  "Description" : "Filters access by the requester's user ID",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-userid",
  "Types" : [ "String" ]
}, {
  "Name" : "aws:username",
  "Description" : "Filters access by the requester's user name",
  "DocPage" : "/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-username",
  "Types" : [ "String" ]
} ]