IAM Per-Service Condition Key Reference

Beyond the global aws:* condition keys available almost everywhere, many AWS services define their own service-specific condition keys — prefixed with that service’s own prefix, and tied to a particular parameter of that service’s API. S3’s s3:x-amz-acl, EC2’s ec2:InstanceType, and DynamoDB’s dynamodb:LeadingKeys are all examples: none of them apply outside their own service. IAM Per-Service Condition Key Reference is a small curated reference of these service-specific keys, grouped by service, each with a short accurate description.

This is deliberately a small, bounded reference — about 7 commonly used services (S3, EC2, DynamoDB, IAM, KMS, Lambda, Secrets Manager) with 3-6 representative condition keys each, roughly 25-30 entries total. It is not a substitute for AWS’s official "Actions, resources, and condition keys" reference page for each service, which is the complete, authoritative source for every condition key a service supports.

For the separate global (aws:*) condition keys that apply across services, see the IAM Global Condition Key Reference tool in this category.

• ~25-30 curated service-specific condition keys across 7 commonly used services.
• Service dropdown filter plus a live text search across key name and description.
• Accurate one-line description for every key.
• Explicitly labeled as a small curated subset, with a pointer to AWS’s authoritative per-service reference pages.
• 100% client-side — nothing is sent anywhere.

1. Pick a service from the dropdown, or leave it on "All services".
2. Optionally type a keyword into the search box (a key fragment or description word).
3. Scan the filtered table for the matching condition key(s) and their descriptions.

Example 1. Select "s3" → surfaces s3:x-amz-acl, s3:prefix, s3:delimiter, s3:x-amz-server-side-encryption, s3:VersionId.

Example 2. Select "dynamodb" and search "key" → surfaces dynamodb:LeadingKeys.

Example 3 — cross-service search. Leave service on "All" and search "tag" → surfaces the ResourceTag/ variadic keys from EC2, IAM, and Secrets Manager side by side.

• Groups condition keys by the service they actually apply to, unlike a flat global list.
• Search by meaning, not just exact key name.
• Honest scope — clearly a small curated subset with a pointer to AWS’s authoritative per-service reference pages.
• Private — runs entirely in your browser.