how to define one condition that validate at least one key in iam aws policy

Question

I check a solution to define a policy that accept only one of both IP addresses as source IP "OR" a source VPC (pool of private IP addresses) - PSB

By definition, there is an "AND" between the keys in same condition (https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html)

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "11.11.11.11/32",
                        "22.22.22.22/32"
                    ]
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                },
                "StringNotEquals": {
                    "aws:SourceVpc": [
                        "vpc-00222222222222"
                    ]
                }
            }
        }
    ] 
}

thanks

Answer 1

You have to duplicate your statements for OR. I know that's code duplication and its not "pretty", but this is how it is done (I'm not sure what you want to do with your Bool):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "11.11.11.11/32",
                        "22.22.22.22/32"
                    ]
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                }
            }
        },
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
               "Bool": {
                    "aws:ViaAWSService": "false"
                },
                "StringNotEquals": {
                    "aws:SourceVpc": [
                        "vpc-00222222222222"
                    ]
                }
            }
        },

    ] 
}