IAM condition keys for accessing data in Amazon Neptune
Using condition keys, you can specify conditions in an IAM policy statement so that the statement takes effect only when the conditions are true.
The condition keys that you can use in Neptune data-access policy statements fall into the following categories:
Global condition keys – The subset of Amazon global condition keys that Neptune supports in data-access policy statements is listed below.
Service-specific condition keys – These are keys defined by Neptune specifically for use in data-access policy statements. At present there is only one, neptune-db:QueryLanguage, which grants access only if a specific query language is being used.
Amazon global condition context keys supported by Neptune in data-access policy statements
The following table lists the subset of Amazon global condition context keys that Amazon Neptune supports for use in data-access policy statements:
Condition Keys | Description | Type |
---|---|---|
aws:CurrentTime |
Filters access by the current date and time of the request. | String |
aws:EpochTime |
Filters access by date and time of the request expressed as a UNIX epoch value. | Numeric |
aws:PrincipalAccount |
Filters access by the account to which the requesting principal belongs. | String |
aws:PrincipalArn |
Filters access by the ARN of the principal that made the request. | String |
aws:PrincipalIsAWSService |
Allows access only if the call is being made directly by an Amazon service principal. | Boolean |
aws:PrincipalOrgID |
Filters access by the identifier of the organization in Amazon Organizations to which the requesting principal belongs. | String |
aws:PrincipalOrgPaths |
Filters access by the Amazon Organizations path for the principal who is making the request. | String |
aws:PrincipalTag |
Filters access by a tag attached to the principal making the request. | String |
aws:PrincipalType |
Filters access by the type of principal making the request. | String |
aws:RequestedRegion |
Filters access by the Amazon Region that was called in the request. | String |
aws:SecureTransport |
Allows access only if the request was sent using SSL. | Boolean |
aws:SourceIp |
Filters access by the requester's IP address. | String |
aws:TokenIssueTime |
Filters access by the date and time that temporary security credentials were issued. | String |
aws:UserAgent |
Filters access by the requester's client application. | String |
aws:userid |
Filters access by the requester's principal identifier. | String |
aws:ViaAWSService |
Allows access only if an Amazon service made the request on your behalf. | Boolean |
Neptune service-specific condition keys
Neptune supports the following service-specific condition key for IAM policies:
Condition Keys | Description | Type |
---|---|---|
neptune-db:QueryLanguage |
Filters data access by the query language being used. Valid values are: Supported actions are |
String |