Amazonka.IAM.Policy

This module provides data types and combinators that allow you to declare, encode, and decode the IAM JSON policy language. The available Action and Condition keys can be found under the AWS Service Actions and Condition Context Keys for Use in IAM policies documentation.

Lenses and prisms for those wanting to traverse and manipulate policy documents and their constituent elements can be found in the Amazonka.IAM.Policy.Lens module.

Usage

It's recommended that you import and use this module qualified to avoid any ambiguity with prelude functions.

The following is an example of using the Semigroup instance of Policy to construct a document from multiple statements. This example creates a policy that would allow an IAM user sufficient privilege to rotate their credentials:

{-# LANGUAGE OverloadedStrings #-}

import qualified Amazonka.IAM.Policy as Policy

 ( Policy.singleton
       (Policy.allow
           { Policy.action   =
               Policy.some
                   [ "iam:ListUsers"
                   , "iam:GetAccountPasswordPolicy"
                   ]
           , Policy.resource = Policy.any
           })

<> Policy.singleton
       (Policy.allow
           { Policy.action   =
               Policy.some
                   [ "iam:*AccessKey*"
                   , "iam:ChangePassword"
                   , "iam:GetUser"
                   , "iam:*ServiceSpecificCredential*"
                   , "iam:*SigningCertificate*"
                   ]
           , Policy.resource =
               Policy.some
                   [ "arn:aws:iam::*:user/${aws:username}"
                   ]
           })
 )

Which results in the following encoded IAM JSON policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "iam:ListUsers",
        "iam:GetAccountPasswordPolicy"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "iam:*AccessKey*",
        "iam:ChangePassword",
        "iam:GetUser",
        "iam:*ServiceSpecificCredential*",
        "iam:*SigningCertificate*"
      ],
      "Resource": "arn:aws:iam::*:user/${aws:username}"
    }
  ]
}

You can also use the OverloadedLists extension with the document smart constructor to create a Policy using the IsList instance for NonEmpty. The following example sets up S3 bucket management:

{-# LANGUAGE OverloadedLists   #-}
{-# LANGUAGE OverloadedStrings #-}

import qualified Amazonka.IAM.Policy as Policy

Policy.document
    [ Policy.allow
        { Policy.action   = Policy.some ["s3:*"]
        , Policy.resource =
            Policy.some
                [ "arn:aws:s3:::BUCKET-NAME"
                , "arn:aws:s3:::BUCKET-NAME/*"
                ]
        }
    , Policy.deny
        { Policy.action   = Policy.not ["s3:*"]
        , Policy.resource =
            Policy.not
                [
                , "arn:aws:s3:::BUCKET-NAME"
                , "arn:aws:s3:::BUCKET-NAME/*"
                ]
        }
    ]

Resulting in the following encoded IAM JSON policy document:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::<BUCKET-NAME>",
        "arn:aws:s3:::<BUCKET-NAME>/*"
      ]
    },
    {
      "Effect": "Deny",
      "NotAction": "s3:*",
      "NotResource": [
        "arn:aws:s3:::<BUCKET-NAME>",
        "arn:aws:s3:::<BUCKET-NAME>/*"
      ]
    }
  ]
}

Please be aware that the use of OverloadedLists and NonEmpty will error if document is passed an empty list.

Policy Documents

type Document = Policy Statement

A policy document is a non-empty list of IAM statements with a supported version.

The statements of a policy document can be traversed and manipulated via the Functor, Foldable, and Traverseable instances. You can use the Semigroup instance to concatenate multiple Policy documents together, preserving the highest supported version and first encountered Id.

Grammar

policy  = {
    <version_block?>
    <id_block?>
    <statement_block>
}

data Policy a

Constructors

Policy

Fields

• version :: !(Maybe Version)
• id :: !(Maybe Id)
• statement :: !(NonEmpty a)

Instances

Functor Policy

Defined in Amazonka.IAM.Policy

Methods

fmap :: (a -> b) -> Policy a -> Policy b

(<$) :: a -> Policy b -> Policy a

Foldable Policy

Defined in Amazonka.IAM.Policy

Methods

fold :: Monoid m => Policy m -> m

foldMap :: Monoid m => (a -> m) -> Policy a -> m

foldr :: (a -> b -> b) -> b -> Policy a -> b

foldr' :: (a -> b -> b) -> b -> Policy a -> b

foldl :: (b -> a -> b) -> b -> Policy a -> b

foldl' :: (b -> a -> b) -> b -> Policy a -> b

foldr1 :: (a -> a -> a) -> Policy a -> a

foldl1 :: (a -> a -> a) -> Policy a -> a

toList :: Policy a -> [a]

null :: Policy a -> Bool

length :: Policy a -> Int

elem :: Eq a => a -> Policy a -> Bool

maximum :: Ord a => Policy a -> a

minimum :: Ord a => Policy a -> a

sum :: Num a => Policy a -> a

product :: Num a => Policy a -> a

Traversable Policy

Defined in Amazonka.IAM.Policy

Methods

traverse :: Applicative f => (a -> f b) -> Policy a -> f (Policy b)

sequenceA :: Applicative f => Policy (f a) -> f (Policy a)

mapM :: Monad m => (a -> m b) -> Policy a -> m (Policy b)

sequence :: Monad m => Policy (m a) -> m (Policy a)

Eq a => Eq (Policy a)

Defined in Amazonka.IAM.Policy

Methods

(==) :: Policy a -> Policy a -> Bool

(/=) :: Policy a -> Policy a -> Bool

Ord a => Ord (Policy a)

Defined in Amazonka.IAM.Policy

Methods

compare :: Policy a -> Policy a -> Ordering

(<) :: Policy a -> Policy a -> Bool

(<=) :: Policy a -> Policy a -> Bool

(>) :: Policy a -> Policy a -> Bool

(>=) :: Policy a -> Policy a -> Bool

max :: Policy a -> Policy a -> Policy a

min :: Policy a -> Policy a -> Policy a

Show a => Show (Policy a)

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Policy a -> ShowS

show :: Policy a -> String

showList :: [Policy a] -> ShowS

Generic (Policy a)

Defined in Amazonka.IAM.Policy

Associated Types

type Rep (Policy a) :: * -> *

Methods

from :: Policy a -> Rep (Policy a) x

to :: Rep (Policy a) x -> Policy a

Semigroup (Policy a)

Defined in Amazonka.IAM.Policy

Methods

(<>) :: Policy a -> Policy a -> Policy a

sconcat :: NonEmpty (Policy a) -> Policy a

stimes :: Integral b => b -> Policy a -> Policy a

Hashable a => Hashable (Policy a)

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Policy a -> Int

hash :: Policy a -> Int

ToJSON a => ToJSON (Policy a)

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Policy a -> Value

toEncoding :: Policy a -> Encoding

toJSONList :: [Policy a] -> Value

toEncodingList :: [Policy a] -> Encoding

FromJSON a => FromJSON (Policy a)

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser (Policy a)

parseJSONList :: Value -> Parser [Policy a]

type Rep (Policy a)

Defined in Amazonka.IAM.Policy

type Rep (Policy a) = D1 (MetaData "Policy" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Policy" PrefixI True) (S1 (MetaSel (Just "version") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Version)) :*: (S1 (MetaSel (Just "id") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Id)) :*: S1 (MetaSel (Just "statement") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (NonEmpty a)))))

Constructing Policies

document :: NonEmpty a -> Policy a

Construct a policy from a collection of NonEmpty Statements using the default 2012-10-17 version and no identifier.

Example

>>> encode' $ document (pure allow <> pure deny)
{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": []
        },
        {
            "Effect": "Deny",
            "Action": []
        }
    ],
    "Version": "2012-10-17"
}

singleton :: a -> Policy a

Construct a policy from a single Statement using the default 2012-10-17 version and no identifier.

Example

>>> encode' $ singleton (allow { resource = any })
{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [],
            "Resource": "*"
        }
    ],
    "Version": "2012-10-17"
}

Encoding

encode :: Policy Statement -> ByteString

Encode the IAM policy document as JSON.

Example

>>> encode $ singleton allow
"{\"Statement\":[{\"Effect\":\"Allow\",\"Action\":[]}],\"Version\":\"2012-10-17\"}"

Language Elements

IAM JSON policy documents are made up of elements. The elements are listed here roughly in the general order you use them in a policy.

The details of what goes into a policy vary for each service, depending on what actions the service makes available, what types of resources it contains, and so on. When you're writing policies for a specific service, it's helpful to see examples of policies for that service. View the AWS Services That Work with IAM documentation for more information.

This library attempts to stick as closely as possible to the IAM policy language grammar and its specific terminology while providing a modicum of safety without going overboard with type-level features. To support this, the concept of Element vs NotElement and "*" wildcards are generalised by the introduction of two additional types not specified directly in the language grammar.

Firstly there is the Block type which allows us to negate Principal, Action, and Resource elements via the related NotPrincipal, NotAction, and NotResource elements. Secondly the Match type provides a way to generally specific Some values for an element, or the Wildcard match equivalent to "*". Combinators are then provided for the common cases.

Example

>>> encode' $ singleton (allow { action = some ["foo", "bar"] })
...
            "Effect": "Allow",
            "Action": [
                "foo",
                "bar"
            ]
...

>>> encode' $ singleton (allow { action = not ["baz"] })
...
            "Effect": "Allow",
            "NotAction": "baz"
...

>>> encode' $ singleton (allow { action = any })
...
            "Effect": "Allow",
            "Action": "*"
...

>>> encode' $ singleton (allow { action = none })
...
            "Effect": "Allow",
            "NotAction": "*"
...

The above examples work identically for the action, resource, and principal statement elements.

data Block a

A Block is a shared type denoting blocks of the policy language grammar.

This is used by the Principal, Action, Resource elements of the policy language.

Grammar

<name_block> = ("Name" | "NotName") : <match_block>

Constructors

Match !(Match a)

Not !(Match a)

Instances

Functor Block

Defined in Amazonka.IAM.Policy

Methods

fmap :: (a -> b) -> Block a -> Block b

(<$) :: a -> Block b -> Block a

Foldable Block

Defined in Amazonka.IAM.Policy

Methods

fold :: Monoid m => Block m -> m

foldMap :: Monoid m => (a -> m) -> Block a -> m

foldr :: (a -> b -> b) -> b -> Block a -> b

foldr' :: (a -> b -> b) -> b -> Block a -> b

foldl :: (b -> a -> b) -> b -> Block a -> b

foldl' :: (b -> a -> b) -> b -> Block a -> b

foldr1 :: (a -> a -> a) -> Block a -> a

foldl1 :: (a -> a -> a) -> Block a -> a

toList :: Block a -> [a]

null :: Block a -> Bool

length :: Block a -> Int

elem :: Eq a => a -> Block a -> Bool

maximum :: Ord a => Block a -> a

minimum :: Ord a => Block a -> a

sum :: Num a => Block a -> a

product :: Num a => Block a -> a

Traversable Block

Defined in Amazonka.IAM.Policy

Methods

traverse :: Applicative f => (a -> f b) -> Block a -> f (Block b)

sequenceA :: Applicative f => Block (f a) -> f (Block a)

mapM :: Monad m => (a -> m b) -> Block a -> m (Block b)

sequence :: Monad m => Block (m a) -> m (Block a)

Eq a => Eq (Block a)

Defined in Amazonka.IAM.Policy

Methods

(==) :: Block a -> Block a -> Bool

(/=) :: Block a -> Block a -> Bool

Ord a => Ord (Block a)

Defined in Amazonka.IAM.Policy

Methods

compare :: Block a -> Block a -> Ordering

(<) :: Block a -> Block a -> Bool

(<=) :: Block a -> Block a -> Bool

(>) :: Block a -> Block a -> Bool

(>=) :: Block a -> Block a -> Bool

max :: Block a -> Block a -> Block a

min :: Block a -> Block a -> Block a

Show a => Show (Block a)

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Block a -> ShowS

show :: Block a -> String

showList :: [Block a] -> ShowS

Generic (Block a)

Defined in Amazonka.IAM.Policy

Associated Types

type Rep (Block a) :: * -> *

Methods

from :: Block a -> Rep (Block a) x

to :: Rep (Block a) x -> Block a

Hashable a => Hashable (Block a)

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Block a -> Int

hash :: Block a -> Int

type Rep (Block a)

Defined in Amazonka.IAM.Policy

type Rep (Block a) = D1 (MetaData "Block" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Match" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Match a))) :+: C1 (MetaCons "Not" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Match a))))

data Match a

A Match is a shared type used to denote wildcards in the policy language grammar.

This is used by the Principal, Action, Resource elements of the policy language.

Grammar

<match_block> = ("*" | <item>)

Constructors

Some !a

Wildcard

Instances

Functor Match

Defined in Amazonka.IAM.Policy

Methods

fmap :: (a -> b) -> Match a -> Match b

(<$) :: a -> Match b -> Match a

Foldable Match

Defined in Amazonka.IAM.Policy

Methods

fold :: Monoid m => Match m -> m

foldMap :: Monoid m => (a -> m) -> Match a -> m

foldr :: (a -> b -> b) -> b -> Match a -> b

foldr' :: (a -> b -> b) -> b -> Match a -> b

foldl :: (b -> a -> b) -> b -> Match a -> b

foldl' :: (b -> a -> b) -> b -> Match a -> b

foldr1 :: (a -> a -> a) -> Match a -> a

foldl1 :: (a -> a -> a) -> Match a -> a

toList :: Match a -> [a]

null :: Match a -> Bool

length :: Match a -> Int

elem :: Eq a => a -> Match a -> Bool

maximum :: Ord a => Match a -> a

minimum :: Ord a => Match a -> a

sum :: Num a => Match a -> a

product :: Num a => Match a -> a

Traversable Match

Defined in Amazonka.IAM.Policy

Methods

traverse :: Applicative f => (a -> f b) -> Match a -> f (Match b)

sequenceA :: Applicative f => Match (f a) -> f (Match a)

mapM :: Monad m => (a -> m b) -> Match a -> m (Match b)

sequence :: Monad m => Match (m a) -> m (Match a)

Eq a => Eq (Match a)

Defined in Amazonka.IAM.Policy

Methods

(==) :: Match a -> Match a -> Bool

(/=) :: Match a -> Match a -> Bool

Ord a => Ord (Match a)

Defined in Amazonka.IAM.Policy

Methods

compare :: Match a -> Match a -> Ordering

(<) :: Match a -> Match a -> Bool

(<=) :: Match a -> Match a -> Bool

(>) :: Match a -> Match a -> Bool

(>=) :: Match a -> Match a -> Bool

max :: Match a -> Match a -> Match a

min :: Match a -> Match a -> Match a

Show a => Show (Match a)

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Match a -> ShowS

show :: Match a -> String

showList :: [Match a] -> ShowS

Generic (Match a)

Defined in Amazonka.IAM.Policy

Associated Types

type Rep (Match a) :: * -> *

Methods

from :: Match a -> Rep (Match a) x

to :: Rep (Match a) x -> Match a

Semigroup a => Semigroup (Match a)

Defined in Amazonka.IAM.Policy

Methods

(<>) :: Match a -> Match a -> Match a

sconcat :: NonEmpty (Match a) -> Match a

stimes :: Integral b => b -> Match a -> Match a

(Semigroup a, Monoid a) => Monoid (Match a)

Defined in Amazonka.IAM.Policy

Methods

mempty :: Match a

mappend :: Match a -> Match a -> Match a

mconcat :: [Match a] -> Match a

Hashable a => Hashable (Match a)

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Match a -> Int

hash :: Match a -> Int

ToJSON a => ToJSON (Match a)

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Match a -> Value

toEncoding :: Match a -> Encoding

toJSONList :: [Match a] -> Value

toEncodingList :: [Match a] -> Encoding

FromJSON a => FromJSON (Match a)

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser (Match a)

parseJSONList :: Value -> Parser [Match a]

type Rep (Match a)

Defined in Amazonka.IAM.Policy

type Rep (Match a) = D1 (MetaData "Match" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Some" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 a)) :+: C1 (MetaCons "Wildcard" PrefixI False) (U1 :: * -> *))

Specifying and Negating Elements

some :: a -> Block a

Match one or more elements.

not :: a -> Block a

Negate a match of one or more elements.

not is the negation of some.

any :: Block a

Match any element with a wildcard.

none :: Block a

Match no element with a negated wildcard.

none is the negation of any.

Version

data Version

The Version elements specifies the language syntax rules that are to be used to process this policy. If you include features that are not available in the specified version, then your policy will generate errors or not work the way you intend. As a general rule, you should specify the most recent version available, unless you depend on a feature that was deprecated in later versions.

Grammar

<version_block> = "Version" : ("2008-10-17" | "2012-10-17")

Example

>>> JSON.encode Version_2012_10_17
"\"2012-10-17\""

Constructors

Version_2008_10_17

Version_2012_10_17

Instances

Eq Version

Defined in Amazonka.IAM.Policy

Methods

(==) :: Version -> Version -> Bool

(/=) :: Version -> Version -> Bool

Ord Version

Defined in Amazonka.IAM.Policy

Methods

compare :: Version -> Version -> Ordering

(<) :: Version -> Version -> Bool

(<=) :: Version -> Version -> Bool

(>) :: Version -> Version -> Bool

(>=) :: Version -> Version -> Bool

max :: Version -> Version -> Version

min :: Version -> Version -> Version

Show Version

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Version -> ShowS

show :: Version -> String

showList :: [Version] -> ShowS

Generic Version

Defined in Amazonka.IAM.Policy

Associated Types

type Rep Version :: * -> *

Methods

from :: Version -> Rep Version x

to :: Rep Version x -> Version

Semigroup Version

'(<>)' always chooses the newest version.

Defined in Amazonka.IAM.Policy

Methods

(<>) :: Version -> Version -> Version

sconcat :: NonEmpty Version -> Version

stimes :: Integral b => b -> Version -> Version

Hashable Version

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Version -> Int

hash :: Version -> Int

ToJSON Version

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Version -> Value

toEncoding :: Version -> Encoding

toJSONList :: [Version] -> Value

toEncodingList :: [Version] -> Encoding

FromJSON Version

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Version

parseJSONList :: Value -> Parser [Version]

type Rep Version

Defined in Amazonka.IAM.Policy

type Rep Version = D1 (MetaData "Version" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Version_2008_10_17" PrefixI False) (U1 :: * -> *) :+: C1 (MetaCons "Version_2012_10_17" PrefixI False) (U1 :: * -> *))

Id

newtype Id

The Id element specifies an optional identifier for the policy. The ID is used differently in different services.

For services that let you set an ID element, we recommend you use a UUID (GUID) for the value, or incorporate a UUID as part of the ID to ensure uniqueness.

Note: Some AWS services (for example, Amazon SQS or Amazon SNS) might require this element and have uniqueness requirements for it. For service-specific information about writing policies, refer to the documentation for the service you're working with.

Use the id record field to set the Id of a Policy document.

Grammar

<id_block> = "Id" : <policy_id_string>

Example

>>> encode' $ (singleton allow) { id = Just "123" }
{
...
    "Id": "123"
}

Constructors

Id

Fields

• fromId :: Text

Instances

Eq Id

Defined in Amazonka.IAM.Policy

Methods

(==) :: Id -> Id -> Bool

(/=) :: Id -> Id -> Bool

Ord Id

Defined in Amazonka.IAM.Policy

Methods

compare :: Id -> Id -> Ordering

(<) :: Id -> Id -> Bool

(<=) :: Id -> Id -> Bool

(>) :: Id -> Id -> Bool

(>=) :: Id -> Id -> Bool

max :: Id -> Id -> Id

min :: Id -> Id -> Id

Show Id

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Id -> ShowS

show :: Id -> String

showList :: [Id] -> ShowS

IsString Id

Defined in Amazonka.IAM.Policy

Methods

fromString :: String -> Id

Hashable Id

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Id -> Int

hash :: Id -> Int

ToJSON Id

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Id -> Value

toEncoding :: Id -> Encoding

toJSONList :: [Id] -> Value

toEncodingList :: [Id] -> Encoding

FromJSON Id

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Id

parseJSONList :: Value -> Parser [Id]

Statement

data Statement

The Statement element is the main element for a policy. This element is required. It can include multiple elements (see the subsequent sections in this page). The Statement element contains an array of individual statements.

Grammar

<statement_block> = "Statement" : [ <statement>, <statement>, ... ]

<statement> = {
    <sid_block?>,
    <principal_block?>,
    <effect_block>,
    <action_block>,
    <resource_block>,
    <condition_block?>
}

Constructors

Statement

Fields

• sid :: !(Maybe Sid)
• principal :: !(Maybe (Block Principal))
• effect :: !Effect
• action :: !(Block [Action])
• resource :: !(Block [Resource])
• condition :: !(Maybe Condition)

Instances

Eq Statement

Defined in Amazonka.IAM.Policy

Methods

(==) :: Statement -> Statement -> Bool

(/=) :: Statement -> Statement -> Bool

Ord Statement

Defined in Amazonka.IAM.Policy

Methods

compare :: Statement -> Statement -> Ordering

(<) :: Statement -> Statement -> Bool

(<=) :: Statement -> Statement -> Bool

(>) :: Statement -> Statement -> Bool

(>=) :: Statement -> Statement -> Bool

max :: Statement -> Statement -> Statement

min :: Statement -> Statement -> Statement

Show Statement

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Statement -> ShowS

show :: Statement -> String

showList :: [Statement] -> ShowS

Generic Statement

Defined in Amazonka.IAM.Policy

Associated Types

type Rep Statement :: * -> *

Methods

from :: Statement -> Rep Statement x

to :: Rep Statement x -> Statement

Hashable Statement

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Statement -> Int

hash :: Statement -> Int

ToJSON Statement

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Statement -> Value

toEncoding :: Statement -> Encoding

toJSONList :: [Statement] -> Value

toEncodingList :: [Statement] -> Encoding

FromJSON Statement

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Statement

parseJSONList :: Value -> Parser [Statement]

type Rep Statement

Defined in Amazonka.IAM.Policy

type Rep Statement = D1 (MetaData "Statement" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Statement" PrefixI True) ((S1 (MetaSel (Just "sid") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Sid)) :*: (S1 (MetaSel (Just "principal") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe (Block Principal))) :*: S1 (MetaSel (Just "effect") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Effect))) :*: (S1 (MetaSel (Just "action") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Block [Action])) :*: (S1 (MetaSel (Just "resource") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Block [Resource])) :*: S1 (MetaSel (Just "condition") NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (Maybe Condition))))))

Constructing Statements

allow :: Statement

Create a new statement with the effect set to Allow.

deny :: Statement

Create a new statement with the effect set to Deny.

Sid

newtype Sid

The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign a Sid value to each statement in a statement array. In services that let you specify an ID element, such as SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In IAM, the Sid value must be unique within a JSON policy.

In IAM, the Sid is not exposed in the IAM API. You can't retrieve a particular statement based on this ID.

Note: Some AWS services (for example, Amazon SQS or Amazon SNS) might require this element and have uniqueness requirements for it. For service-specific information about writing policies, refer to the documentation for the service you're working with.

Use the sid record field to set the Sid of a Statement.

Grammar

<sid_block> = "Sid" : <sid_string>

Example

>>> encode' $ singleton (allow { sid = Just "cd3ad3d9-2776-4ef1-a904-4c229d1642ee" })
{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [],
            "Sid": "cd3ad3d9-2776-4ef1-a904-4c229d1642ee"
        }
    ],
    "Version": "2012-10-17"
}

Constructors

Sid

Fields

• fromSid :: Text

Instances

Eq Sid

Defined in Amazonka.IAM.Policy

Methods

(==) :: Sid -> Sid -> Bool

(/=) :: Sid -> Sid -> Bool

Ord Sid

Defined in Amazonka.IAM.Policy

Methods

compare :: Sid -> Sid -> Ordering

(<) :: Sid -> Sid -> Bool

(<=) :: Sid -> Sid -> Bool

(>) :: Sid -> Sid -> Bool

(>=) :: Sid -> Sid -> Bool

max :: Sid -> Sid -> Sid

min :: Sid -> Sid -> Sid

Show Sid

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Sid -> ShowS

show :: Sid -> String

showList :: [Sid] -> ShowS

IsString Sid

Defined in Amazonka.IAM.Policy

Methods

fromString :: String -> Sid

Hashable Sid

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Sid -> Int

hash :: Sid -> Int

ToJSON Sid

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Sid -> Value

toEncoding :: Sid -> Encoding

toJSONList :: [Sid] -> Value

toEncodingList :: [Sid] -> Encoding

FromJSON Sid

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Sid

parseJSONList :: Value -> Parser [Sid]

Principal

data Principal

Use the Principal element to specify the user (IAM user, federated user, or assumed-role user), AWS account, AWS service, or other principal entity that is allowed or denied access to a resource. You use the Principal element in the trust policies for IAM roles and in resource-based policies—that is, in policies that you embed directly in a resource. For example, you can embed such policies in an Amazon S3 bucket, an Amazon Glacier vault, an Amazon SNS topic, an Amazon SQS queue, or an AWS KMS customer master key (CMK).

Use the Principal element in these ways:

In IAM roles, use the Principal element in the role's trust policy to specify who can assume the role. For cross-account access, you must specify the 12-digit identifier of the trusted account.

Note: After you create the role, you can change the account to "*" to allow everyone to assume the role. If you do this, we strongly recommend that you limit who can access the role through other means, such as a Condition element that limits access to only certain IP addresses. Do not leave your role accessible to everyone!

In resource-based policies, use the Principal element to specify the accounts or users who are allowed to access the resource.

You can use Not to negate the meaning of a Principal element.

Grammar

<principal_block> = ("Principal" | "NotPrincipal") : ("*" | <principal_map>)

<principal_map> = { <principal_map_entry>, <principal_map_entry>, ... }

<principal_map_entry> = ("AWS" | "Federated" | "Service") :
    [<principal_id_string>, <principal_id_string>, ...]

Example

>>> encode' $ singleton (allow { principal = Just $ not Everyone })
{
    "Statement": [
        {
            "Effect": "Allow",
            "NotPrincipal": "*",
            "Action": []
        }
    ],
    "Version": "2012-10-17"
}

>>> encode' $ singleton (allow { principal = Just $ some (AWS (pure "arn:foo:::bar")) })
{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [],
            "Principal": {
                "AWS": [
                    "arn:foo:::bar"
                ]
            }
        }
    ],
    "Version": "2012-10-17"
}

Constructors

Everyone

AWS !(NonEmpty Text)

Federated !Text

Service !(NonEmpty Text)

CanonicalUser !Text

Instances

Eq Principal

Defined in Amazonka.IAM.Policy

Methods

(==) :: Principal -> Principal -> Bool

(/=) :: Principal -> Principal -> Bool

Ord Principal

Defined in Amazonka.IAM.Policy

Methods

compare :: Principal -> Principal -> Ordering

(<) :: Principal -> Principal -> Bool

(<=) :: Principal -> Principal -> Bool

(>) :: Principal -> Principal -> Bool

(>=) :: Principal -> Principal -> Bool

max :: Principal -> Principal -> Principal

min :: Principal -> Principal -> Principal

Show Principal

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Principal -> ShowS

show :: Principal -> String

showList :: [Principal] -> ShowS

Generic Principal

Defined in Amazonka.IAM.Policy

Associated Types

type Rep Principal :: * -> *

Methods

from :: Principal -> Rep Principal x

to :: Rep Principal x -> Principal

Hashable Principal

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Principal -> Int

hash :: Principal -> Int

ToJSON Principal

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Principal -> Value

toEncoding :: Principal -> Encoding

toJSONList :: [Principal] -> Value

toEncodingList :: [Principal] -> Encoding

FromJSON Principal

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Principal

parseJSONList :: Value -> Parser [Principal]

type Rep Principal

Defined in Amazonka.IAM.Policy

type Rep Principal = D1 (MetaData "Principal" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) ((C1 (MetaCons "Everyone" PrefixI False) (U1 :: * -> *) :+: C1 (MetaCons "AWS" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (NonEmpty Text)))) :+: (C1 (MetaCons "Federated" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: (C1 (MetaCons "Service" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 (NonEmpty Text))) :+: C1 (MetaCons "CanonicalUser" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)))))

Effect

data Effect

The Effect element is required and specifies whether the statement results in an allow or an explicit deny.

By default, access to resources is denied. To allow access to a resource, you must set the Effect element to Allow. To override an allow (for example, to override an allow that is otherwise in force), you set the Effect element to Deny.

See the allow and deny smart constructors to create a Statement with the desired Effect set.

Grammar

<effect_block> = "Effect" : ("Allow" | "Deny")

Constructors

Allow

Deny

Instances

Enum Effect

Defined in Amazonka.IAM.Policy

Methods

succ :: Effect -> Effect

pred :: Effect -> Effect

toEnum :: Int -> Effect

fromEnum :: Effect -> Int

enumFrom :: Effect -> [Effect]

enumFromThen :: Effect -> Effect -> [Effect]

enumFromTo :: Effect -> Effect -> [Effect]

enumFromThenTo :: Effect -> Effect -> Effect -> [Effect]

Eq Effect

Defined in Amazonka.IAM.Policy

Methods

(==) :: Effect -> Effect -> Bool

(/=) :: Effect -> Effect -> Bool

Ord Effect

Defined in Amazonka.IAM.Policy

Methods

compare :: Effect -> Effect -> Ordering

(<) :: Effect -> Effect -> Bool

(<=) :: Effect -> Effect -> Bool

(>) :: Effect -> Effect -> Bool

(>=) :: Effect -> Effect -> Bool

max :: Effect -> Effect -> Effect

min :: Effect -> Effect -> Effect

Show Effect

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Effect -> ShowS

show :: Effect -> String

showList :: [Effect] -> ShowS

Generic Effect

Defined in Amazonka.IAM.Policy

Associated Types

type Rep Effect :: * -> *

Methods

from :: Effect -> Rep Effect x

to :: Rep Effect x -> Effect

Hashable Effect

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Effect -> Int

hash :: Effect -> Int

ToJSON Effect

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Effect -> Value

toEncoding :: Effect -> Encoding

toJSONList :: [Effect] -> Value

toEncodingList :: [Effect] -> Encoding

FromJSON Effect

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Effect

parseJSONList :: Value -> Parser [Effect]

type Rep Effect

Defined in Amazonka.IAM.Policy

type Rep Effect = D1 (MetaData "Effect" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) (C1 (MetaCons "Allow" PrefixI False) (U1 :: * -> *) :+: C1 (MetaCons "Deny" PrefixI False) (U1 :: * -> *))

Action

newtype Action

The Action element describes the specific action or actions that will be allowed or denied. Statements must include either an Action or NotAction element. Each AWS service has its own set of actions that describe tasks that you can perform with that service.

You can use Not to negate the meaning of a list of Action elements.

Grammar

<action_block> = ("Action" | "NotAction") :
    ("*" | [<action_string>, <action_string>, ...])

Constructors

Action

Fields

• fromAction :: Text

Instances

Eq Action

Defined in Amazonka.IAM.Policy

Methods

(==) :: Action -> Action -> Bool

(/=) :: Action -> Action -> Bool

Ord Action

Defined in Amazonka.IAM.Policy

Methods

compare :: Action -> Action -> Ordering

(<) :: Action -> Action -> Bool

(<=) :: Action -> Action -> Bool

(>) :: Action -> Action -> Bool

(>=) :: Action -> Action -> Bool

max :: Action -> Action -> Action

min :: Action -> Action -> Action

Show Action

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Action -> ShowS

show :: Action -> String

showList :: [Action] -> ShowS

IsString Action

Defined in Amazonka.IAM.Policy

Methods

fromString :: String -> Action

Hashable Action

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Action -> Int

hash :: Action -> Int

ToJSON Action

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Action -> Value

toEncoding :: Action -> Encoding

toJSONList :: [Action] -> Value

toEncodingList :: [Action] -> Encoding

FromJSON Action

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Action

parseJSONList :: Value -> Parser [Action]

Resource

newtype Resource

The Resource element specifies the object or objects that the statement covers. Statements must include either a Resource or a NotResource element.

Each service has its own set of resources. Although you always use an ARN to specify a resource, the details of the ARN for a resource depend on the service and the resource. For information about how to specify a resource, refer to the documentation for the service whose resources you're writing a statement for.

Note: Some services do not let you specify actions for individual resources; instead, any actions that you list in the Action or NotAction element apply to all resources in that service. In these cases, you use the wildcard "*" in the Resource element.

You can use Not to negate the meaning of a list of Resource elements.

Grammar

<resource_block> = ("Resource" | "NotResource") :
    ("*" | [<resource_string>, <resource_string>, ...])

Constructors

Resource

Fields

• fromResource :: Text

Instances

Eq Resource

Defined in Amazonka.IAM.Policy

Methods

(==) :: Resource -> Resource -> Bool

(/=) :: Resource -> Resource -> Bool

Ord Resource

Defined in Amazonka.IAM.Policy

Methods

compare :: Resource -> Resource -> Ordering

(<) :: Resource -> Resource -> Bool

(<=) :: Resource -> Resource -> Bool

(>) :: Resource -> Resource -> Bool

(>=) :: Resource -> Resource -> Bool

max :: Resource -> Resource -> Resource

min :: Resource -> Resource -> Resource

Show Resource

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Resource -> ShowS

show :: Resource -> String

showList :: [Resource] -> ShowS

IsString Resource

Defined in Amazonka.IAM.Policy

Methods

fromString :: String -> Resource

Hashable Resource

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Resource -> Int

hash :: Resource -> Int

ToJSON Resource

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Resource -> Value

toEncoding :: Resource -> Encoding

toJSONList :: [Resource] -> Value

toEncodingList :: [Resource] -> Encoding

FromJSON Resource

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Resource

parseJSONList :: Value -> Parser [Resource]

Condition

newtype Key

A key that will be tested as the target of a Condition.

Constructors

Key

Fields

• fromKey :: Text

Instances

Eq Key

Defined in Amazonka.IAM.Policy

Methods

(==) :: Key -> Key -> Bool

(/=) :: Key -> Key -> Bool

Ord Key

Defined in Amazonka.IAM.Policy

Methods

compare :: Key -> Key -> Ordering

(<) :: Key -> Key -> Bool

(<=) :: Key -> Key -> Bool

(>) :: Key -> Key -> Bool

(>=) :: Key -> Key -> Bool

max :: Key -> Key -> Key

min :: Key -> Key -> Key

Show Key

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Key -> ShowS

show :: Key -> String

showList :: [Key] -> ShowS

IsString Key

Defined in Amazonka.IAM.Policy

Methods

fromString :: String -> Key

Hashable Key

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Key -> Int

hash :: Key -> Int

ToJSON Key

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Key -> Value

toEncoding :: Key -> Encoding

toJSONList :: [Key] -> Value

toEncodingList :: [Key] -> Encoding

FromJSON Key

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Key

parseJSONList :: Value -> Parser [Key]

data Condition

The Condition element (or Condition block) lets you specify conditions for when a policy is in effect. The Condition element is optional. In the Condition element, you build expressions in which you use condition operators (equal, less than, etc.) to match the condition in the policy against values in the request. Condition values can include date, time, the IP address of the requester, the ARN of the request source, the user name, user ID, and the user agent of the requester. Some services let you specify additional values in conditions; for example, Amazon S3 lets you write a condition using the s3:VersionId key, which is unique to that service.

• String: String condition operators let you construct Condition elements that restrict access based on comparing a key to a string value.
• Numeric: Numeric condition operators let you construct Condition elements that restrict access based on comparing a key to an integer or decimal value.
• Date: Date condition operators let you construct Condition elements that restrict access based on comparing a key to a date/time value. You use these condition operators with the aws:CurrentTime key or aws:EpochTime keys. You must specify date/time values with one of the W3C implementations of the ISO 8601 date formats or in epoch (UNIX) time. Wildcards are not permitted for date condition operators.
• Boolean: Boolean conditions let you construct Condition elements that restrict access based on comparing a key to "true" or "false."
• Binary: The BinaryEquals condition operator let you construct Condition elements that test key values that are in binary format. It compares the value of the specified key byte for byte against a base-64 encoded representation of the binary value in the policy.
• IP Address: IP address condition operators let you construct Condition elements that restrict access based on comparing a key to an IPv4 or IPv6 address or range of IP addresses. You use these with the aws:SourceIp key. The value must be in the standard CIDR format (for example, 203.0.113.0/24 or 2001:DB8:1234:5678::/64). If you specify an IP address without the associated routing prefix, IAM uses the default prefix value of /32. Some AWS services support IPv6, using :: to represent a range of 0s. To learn whether a service supports IPv6, see the documentation for that service.
• Amazon Resource Name (ARN): Amazon Resource Name (ARN) condition operators let you construct Condition elements that restrict access based on comparing a key to an ARN. The ARN is considered a string. This value is available for only some services; not all services support request values that can be compared as ARNs.
• Key Existence: You can add IfExists to the end of any condition operator name except the Null condition—for example, StringLikeIfExists. You do this to say "If the policy key is present in the context of the request, process the key as specified in the policy. If the key is not present, the condition evaluate the condition element as true." Other condition elements in the statement can still result in a nonmatch, but not a missing key when checked with ...IfExists.
• Null: Use a Null condition operator to check if a condition key is present at the time of authorization. In the policy statement, use either true (the key doesn't exist — it is null) or false (the key exists and its value is not null). For example, you can use this condition operator to determine whether a user is using their own credentials for the operation or temporary credentials. If the user is using temporary credentials, then the key aws:TokenIssueTime exists and has a value. The following example shows a condition that states that the user must not be using temporary credentials (the key must not exist) for the user to use the Amazon EC2 API.

Grammar

<condition_block> = "Condition" : { <condition_map> }

<condition_map> {
  <condition_type_string> : { <condition_key_string> : <condition_value_list> },
  <condition_type_string> : { <condition_key_string> : <condition_value_list> }, ...
}

<condition_value_list> = [<condition_value>, <condition_value>, ...]

<condition_value> = ("string" | "number" | "Boolean")

Example

>>> encode' $ singleton (allow { condition = Just (Bool "aws:MultiFactorAuthPresent" True) })
{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [],
            "Condition": {
                "Bool": {
                    "aws:MultiFactorAuthPresent": true
                }
            }
        }
    ],
    "Version": "2012-10-17"
}

Constructors

StringEquals !Key !Text

Exact matching, case sensitive.

StringNotEquals !Key !Text

Negated matching.

StringEqualsIgnoreCase !Key !Text

Exact matching, ignoring case.

StringNotEqualsIgnoreCase !Key !Text

Negated matching, ignoring case

StringLike !Key ![Text]

Case-sensitive matching. The values can include a multi-character match wildcard (*) or a single-character match wildcard (?) anywhere in the string.

If a key contains multiple values, StringLike can be qualified with set operators—ForAllValues:StringLike and ForAnyValue:StringLike. For more information, see Creating a Condition That Tests Multiple Key Values (Set Operations).

StringNotLike !Key ![Text]

Negated case-sensitive matching. The values can include a multi-character match wildcard (*) or a single-character match wildcard (?) anywhere in the string.

NumericEquals !Key !Scientific

Matching.

NumericNotEquals !Key !Scientific

Negated matching.

NumericLessThan !Key !Scientific

"Less than" matching.

NumericLessThanEquals !Key !Scientific

"Less than or equals" matching.

NumericGreaterThan !Key !Scientific

"Greater than" matching.

NumericGreaterThanEquals !Key !Scientific

"Greater than or equals" matching.

DateEquals !Key !UTCTime

Matching a specific date.

DateNotEquals !Key !UTCTime

Negated matching.

DateLessThan !Key !UTCTime

Matching before a specific date and time.

DateLessThanEquals !Key !UTCTime

Matching at or before a specific date and time.

DateGreaterThan !Key !UTCTime

Matching after a specific a date and time.

DateGreaterThanEquals !Key !UTCTime

Matching at or after a specific date and time.

Bool !Key !Bool

Boolean matching.

BinaryEquals !Key !ByteString

The BinaryEquals condition operator let you construct Condition elements that test key values that are in binary format. It compares the value of the specified key byte for byte against a base-64 encoded representation of the binary value in the policy.

IpAddress !Key !ByteString

The specified IP address or range.

NotIpAddress !Key !ByteString

All IP addresses except the specified IP address or range.

ArnEquals !Key !Text

Case-sensitive matching of the ARN. Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (*) or a single-character match wildcard (?). These behave identically.

ArnLike !Key !Text

Case-sensitive matching of the ARN. Each of the six colon-delimited components of the ARN is checked separately and each can include a multi-character match wildcard (*) or a single-character match wildcard (?). These behave identically.

ArnNotEquals !Key !Text

Negated matching for ARN. These behave identically.

ArnNotLike !Key !Text

Negated matching for ARN. These behave identically.

Instances

Eq Condition

Defined in Amazonka.IAM.Policy

Methods

(==) :: Condition -> Condition -> Bool

(/=) :: Condition -> Condition -> Bool

Ord Condition

Defined in Amazonka.IAM.Policy

Methods

compare :: Condition -> Condition -> Ordering

(<) :: Condition -> Condition -> Bool

(<=) :: Condition -> Condition -> Bool

(>) :: Condition -> Condition -> Bool

(>=) :: Condition -> Condition -> Bool

max :: Condition -> Condition -> Condition

min :: Condition -> Condition -> Condition

Show Condition

Defined in Amazonka.IAM.Policy

Methods

showsPrec :: Int -> Condition -> ShowS

show :: Condition -> String

showList :: [Condition] -> ShowS

Generic Condition

Defined in Amazonka.IAM.Policy

Associated Types

type Rep Condition :: * -> *

Methods

from :: Condition -> Rep Condition x

to :: Rep Condition x -> Condition

Hashable Condition

Defined in Amazonka.IAM.Policy

Methods

hashWithSalt :: Int -> Condition -> Int

hash :: Condition -> Int

ToJSON Condition

Defined in Amazonka.IAM.Policy

Methods

toJSON :: Condition -> Value

toEncoding :: Condition -> Encoding

toJSONList :: [Condition] -> Value

toEncodingList :: [Condition] -> Encoding

FromJSON Condition

Defined in Amazonka.IAM.Policy

Methods

parseJSON :: Value -> Parser Condition

parseJSONList :: Value -> Parser [Condition]

type Rep Condition

Defined in Amazonka.IAM.Policy

type Rep Condition = D1 (MetaData "Condition" "Amazonka.IAM.Policy" "amazonka-iam-policy-0.0.3-HyVKgyGtg7OFgLcQ9TGNux" False) ((((C1 (MetaCons "StringEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: (C1 (MetaCons "StringNotEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: C1 (MetaCons "StringEqualsIgnoreCase" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)))) :+: (C1 (MetaCons "StringNotEqualsIgnoreCase" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: (C1 (MetaCons "StringLike" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 [Text])) :+: C1 (MetaCons "StringNotLike" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 [Text]))))) :+: ((C1 (MetaCons "NumericEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific)) :+: (C1 (MetaCons "NumericNotEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific)) :+: C1 (MetaCons "NumericLessThan" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific)))) :+: ((C1 (MetaCons "NumericLessThanEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific)) :+: C1 (MetaCons "NumericGreaterThan" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific))) :+: (C1 (MetaCons "NumericGreaterThanEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Scientific)) :+: C1 (MetaCons "DateEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)))))) :+: (((C1 (MetaCons "DateNotEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)) :+: (C1 (MetaCons "DateLessThan" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)) :+: C1 (MetaCons "DateLessThanEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)))) :+: (C1 (MetaCons "DateGreaterThan" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)) :+: (C1 (MetaCons "DateGreaterThanEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 UTCTime)) :+: C1 (MetaCons "Bool" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Bool))))) :+: ((C1 (MetaCons "BinaryEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 ByteString)) :+: (C1 (MetaCons "IpAddress" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 ByteString)) :+: C1 (MetaCons "NotIpAddress" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 ByteString)))) :+: ((C1 (MetaCons "ArnEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: C1 (MetaCons "ArnLike" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text))) :+: (C1 (MetaCons "ArnNotEquals" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)) :+: C1 (MetaCons "ArnNotLike" PrefixI False) (S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Key) :*: S1 (MetaSel (Nothing :: Maybe Symbol) NoSourceUnpackedness SourceStrict DecidedStrict) (Rec0 Text)))))))