A handful of IAM condition keys work everywhere — in any policy statement, regardless of which service's actions the statement covers — because they describe properties of the request itself, not of the service being called. IAM Global Condition Key Reference is a searchable list of these global keys, each prefixed aws: (or sts: for the role-assumption pair), with a short, accurate one-line description of exactly what each one checks.
These are the keys you reach for to restrict access by source IP (aws:SourceIp), require MFA (aws:MultiFactorAuthPresent), require HTTPS (aws:SecureTransport), scope access to a specific AWS Organizations ID (aws:PrincipalOrgID), or check resource/request/principal tags (aws:ResourceTag/, aws:RequestTag/, aws:PrincipalTag/), among others — the building blocks behind most of the condition-based policy generators in this tool suite (MFA-required policies, IP-restricted policies, tag-based access policies, and more).
This reference deliberately covers only the global, cross-service keys. AWS also defines hundreds of additional condition keys that are specific to one particular service — s3:x-amz-acl, ec2:InstanceType, dynamodb:LeadingKeys, and so on — and those are covered separately by this suite's IAM Condition Key Reference (per service) tool, which groups them by service instead of listing them here as if they were universal.