To use AWS condition keys, is it mandatory that they are present in the Request Context?

Question

When I look at a 'Request Context' in Cloudtrail, I see record contents listed here.

1. Is there a mapping between the 'Request Context' record contents and the Condition keys?
   Or is it correct to say that it is not mandatory for a condition to be present in the 'Request Context' but a Condition Key corresponding to the condition may still be available (AWS magic) to be used in a policy to evaluate this request? Are AWS‐wide keys that use prefix aws: available in all Request Contexts?

2. When I use a Condition Key in a policy, how can I be sure that the Condition key is present in the Request Context?
   Of course, I can add an "ifexists" clause to check for the availability of a Condition key but that is a 'catch all' mechanism. How can I be certain that I need not use "Ifexists" clause when checking a Condition in a policy?

I have posted a different but related question here as well.

Answer 1

Cloudtrail event only has a subset of information from the Request Context. We never get to see the whole (details of an) AWS Request Context - a subset of it is logged as Record Contents in the Cloudtrail Event.

Cloudtrail Event and Request Context are 2 different things. You can view some information about the Request Context as Record Contents in the Cloudtrail Event (only AWS sees the whole Request Context and checks it against permissions granted through policies to Allow / Deny the request).

Answer 2

I think you are confusing content of CT log event data:

• CloudTrail Record Contents

with IAM condition keys for CloudTrial:

• Condition Keys for AWS CloudTrail

Also to check if policy key exist using ...IfExists or Null check.

If the key that you specify in a policy condition is not present in the request context, the values do not match.

The first one contains information about API calls in your CT trial, while the second is used in IAM policies to grant conditional permissions.

Answer 3

Check out the Condition Keys Table to find the condition context keys available for an AWS Service that can be used in an IAM policy statement's Condition element.