An access boundary defines the upper bound of what a principal may access. It includes a list of access boundary rules that each defines the resource that may be allowed as well as permissions that may be used on those resources.
A list of access boundary rules which defines the upper bound of the permission a principal may carry. If multiple rules are specified, the effective access boundary is the union of all the access boundary rules attached.
One access boundary can contain at most 10 rules.
AccessBoundaryRule
An access boundary rule defines an upper bound of IAM permissions on a single resource.
The availability condition further constrains the access allowed by the access boundary rule.
If the condition evaluates to true, then this access boundary rule will provide access to the specified resource, assuming the principal has the required permissions for the resource.
If the condition does not evaluate to true, then access to the specified resource will not be available. Note that all access boundary rules in an access boundary are evaluated together as a union. As such, another access boundary rule may allow access to the resource, even if this access boundary rule does not allow access.
To learn which resources support conditions in their IAM policies, see the IAM documentation.
The maximum length of the expression field is 2048 characters.