Global Condition Context with limited service availability about iam-user-guide

[stephswo]

Unfortunately, IAM has no way of knowing if a service supports any of the AWS global condition keys today. The IAM team is aware of this problem, but right now, the only way to know is to check the service documentation sets and hope that they documented them. You can find the landing page for each service doc set on the following docs website: https://docs.aws.amazon.com

The WorkDocs link that you provided is the page in the IAM documentation. This is different than the service documentation that you can find using the link above. If a global (aws:) key is not in these pages, then the service team hasn't told IAM. Links on these IAM pages direct you to the global condition keys because that service DOES support using the keys for all services listed at the top of the page.

Specific to aws:RequestedRegion, I did a Google search:
aws:RequestedRegion site:docs.aws.amazon.com
And the only service that came up was EC2:
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ExamplePolicies_EC2.html#iam-example-region

So the answer is, there is no list. Anywhere. Limited availability means that the only way you can learn whether a service supports these keys is to search the service's documentation. IAM makes these keys available to other services and recommends that they implement them. Those services can choose to support them, but they don't tell IAM. There is no centralized list, and no guarantee that the service even documents the keys if they do support them. Every service in AWS (140+) acts independently.

I can tell you that we know it's a problem. We've improved a similar situation with helping customers learn which actions, resource types, and service-specific condition keys that services support for IAM policies. The page you mentioned is a result of that fix. We now require services to programmatically provide all of the information that you see on the Actions, Resources, and Condition Keys pages: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.html

These pages all come from the service data and are automatically generated.

[ExSport]

@stephswo Thanks for your answer.
Sure, WorkDocs example was taken from service docs but I posted one of the mentioned guides which referenced condition or aws: string.
From your points I understand there is no way how to find out supported services, no official list of them. By reading this post it seems this global key is not service dependent as it restricts API calls to specific regions only.
Comparing all existing documentations it is not clear what is the right answer now.
Thanks for clarifying it a little bit 👍