# 具有多个上下文键或值的条件
<a name="reference_policies_condition-logic-multiple-context-keys-or-values"></a>

您可以使用策略的 `Condition` 元素测试请求中的多个上下文键或单个上下文键的多个值。在以编程方式或通过 Amazon向 Amazon Web Services 管理控制台 发出请求时，请求包含有关您的主体、操作和标签等的信息。您可以使用上下文键测试请求中匹配的上下文键的值，并在策略条件中指定上下文键。要了解请求中包含的信息和数据，请参阅[请求上下文](reference_policies_elements_condition.md#AccessPolicyLanguage_RequestContext)。

**Topics**
+ [多个上下文键或值的评估逻辑](#reference_policies_multiple-conditions-eval)
+ [否定匹配条件运算符的评估逻辑](#reference_policies_multiple-conditions-negated-matching-eval)

## 多个上下文键或值的评估逻辑
<a name="reference_policies_multiple-conditions-eval"></a>

一个 `Condition` 元素可以包含多个条件运算符，而每个条件运算符又可以包含多个上下文键值对。除非另行指定，否则大多数上下文键都支持使用多个值。
+ 如果您的策略语句具有多个[条件运算符](reference_policies_elements_condition_operators.md)，则使用逻辑 `AND` 评估条件运算符。
+ 如果您的策略语句将多个上下文键附加到单个条件运算符，则使用逻辑 `AND` 评估上下文键。
+ 如果单个条件运算符包含一个上下文键的多个值，则使用逻辑 `OR` 评估这些值。
+ 如果单个否定匹配条件运算符包含一个上下文键的多个值，则使用逻辑 `NOR` 评估这些值。

条件元素块中的所有上下文键都必须解析为 true 才能调用所需的 `Allow` 或 `Deny` 效果。下图说明了具有多个条件运算符和上下文键值对的条件的评估逻辑。

![\[条件块显示了如何将 AND 和 OR 应用于多个上下文键和值\]](http://docs.amazonaws.cn/IAM/latest/UserGuide/images/AccessPolicyLanguage_Condition_Block_AND_2.diagram.png)


例如，以下 S3 存储桶策略说明了上图在策略中的表示方式。此条件块包含条件运算符 `StringEquals` 和 `ArnLike`，以及上下文键 `aws:PrincipalTag` 和 `aws:PrincipalArn`。要调用所需的 `Allow` 或 `Deny` 效果，条件元素块中的所有上下文键都必须解析为 true。提出请求的用户必须同时拥有 *department* 和 *role* 这两个主体标签键，包括策略中指定的一个标签键值。此外，发出请求的用户的主体 ARN 必须与策略中指定的 `aws:PrincipalArn` 值之一匹配才能评估为 true。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "ExamplePolicy",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:root"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/department": [
            "finance",
            "hr",
            "legal"
          ],
          "aws:PrincipalTag/role": [
            "audit",
            "security"
          ]
        },
        "ArnLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::222222222222:user/Ana",
            "arn:aws:iam::222222222222:user/Mary"
          ]
        }
      }
    }
  ]
}
```

------

下表显示了 Amazon 如何根据请求中的条件键值来评估此策略。


| 策略条件 | 请求上下文 | 结果 | 
| --- | --- | --- | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: legal<br />aws:PrincipalTag/role: audit<br />aws:PrincipalArn: <br />  arn:aws:iam::222222222222:user/Mary</pre>  |  **匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalTag/role: audit<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Nikki</pre>  | **不匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalTag/role: payroll<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Mary</pre>  | **不匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  |  请求上下文中没有 `aws:PrincipalTag/role`。 <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Mary</pre>  | **不匹配**  | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | 请求上下文中没有 `aws:PrincipalTag`。 <pre>aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Mary</pre>  | **不匹配**  | 

## 否定匹配条件运算符的评估逻辑
<a name="reference_policies_multiple-conditions-negated-matching-eval"></a>

一些[条件运算符](reference_policies_elements_condition_operators.md)（如 `StringNotEquals` 或 `ArnNotLike`），使用否定匹配将策略中的上下文键值对与请求中的上下文键值对进行比较。当使用否定匹配条件运算符为策略中的单个上下文键指定多个值时，有效权限的工作方式类似于逻辑 `NOR`。在否定匹配中，仅当所有值都计算为 false 时，逻辑 `NOR` 或 `NOT OR` 才会返回 true。

下图说明了具有多个条件运算符和上下文键值对的条件的评估逻辑。此图包括上下文键 3 的否定匹配条件运算符。

![\[条件块显示了使用否定匹配条件运算符时，如何将 AND 和 OR 应用于多个上下文键和值\]](http://docs.amazonaws.cn/IAM/latest/UserGuide/images/AccessPolicyLanguage_Condition_Block_AND_Negated_NOR_2.diagram.png)


例如，以下 S3 存储桶策略说明了上图在策略中的表示方式。此条件块包含条件运算符 `StringEquals` 和 `ArnNotLike`，以及上下文键 `aws:PrincipalTag` 和 `aws:PrincipalArn`。要调用所需的 `Allow` 或 `Deny` 效果，条件元素块中的所有上下文键都必须解析为 true。提出请求的用户必须同时拥有 *department* 和 *role* 这两个主体标签键，包括策略中指定的一个标签键值。由于 `ArnNotLike` 条件运算符使用否定匹配，发出请求的用户的主体 ARN 不得与策略中指定的任何 `aws:PrincipalArn` 值匹配才能评估为 true。

------
#### [ JSON ]

****  

```
{
  "Version":"2012-10-17",		 	 	 
  "Statement": [
    {
      "Sid": "ExamplePolicy",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:root"
      },
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::amzn-s3-demo-bucket",
      "Condition": {
        "StringEquals": {
          "aws:PrincipalTag/department": [
            "finance",
            "hr",
            "legal"
          ],
          "aws:PrincipalTag/role": [
            "audit",
            "security"
          ]
        },
        "ArnNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::222222222222:user/Ana",
            "arn:aws:iam::222222222222:user/Mary"
          ]
        }
      }
    }
  ]
}
```

------

下表显示了 Amazon 如何根据请求中的条件键值来评估此策略。


| 策略条件 | 请求上下文 | 结果 | 
| --- | --- | --- | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnNotLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: legal<br />aws:PrincipalTag/role: audit<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Nikki<br /></pre>  |  **匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnNotLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalTag/role: audit<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Mary</pre>  | **不匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnNotLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalTag/role: payroll<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Nikki</pre>  | **不匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnNotLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | >请求上下文中没有 `aws:PrincipalTag/role`。 <pre>aws:PrincipalTag/department: hr<br />aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Nikki</pre>  | **不匹配** | 
|  <pre>"StringEquals": {<br />  "aws:PrincipalTag/department": [<br />    "finance",<br />    "hr",<br />    "legal"<br />  ],<br />  "aws:PrincipalTag/role": [<br />    "audit",<br />    "security"<br />  ]<br />},<br />"ArnNotLike": {<br />  "aws:PrincipalArn": [<br />      "arn:aws:iam::222222222222:user/Ana",<br />      "arn:aws:iam::222222222222:user/Mary"<br />  ]<br />}</pre>  | 请求上下文中没有 `aws:PrincipalTag`。 <pre>aws:PrincipalArn:<br />  arn:aws:iam::222222222222:user/Nikki</pre>  | **不匹配**  |