fix(auth): follow IAM's rules for policy variables in condition values

crates/auth/src/policy/condition/tests/multivalued.rs

@@ -284,26 +284,35 @@ fn policy_variable_no_expansion_needed() {
 }
 
 #[test]
-fn policy_variable_unresolvable_left_literal() {
+fn policy_variable_unresolvable_matches_nothing() {
     let ctx = TestContext::new().with("k", vec!["${aws:PrincipalTag/Missing}"]);
-    // Unresolvable variable stays literal — matches if context has the literal
-    assert!(evaluate_condition(
+    // A variable whose key the request does not carry matches nothing, even
+    // the literal text of the variable (measured, issue #534 cell E9).
+    assert!(!evaluate_condition(
         &cond(
             ConditionOperator::StringEquals,
             "k",
             vec!["${aws:PrincipalTag/Missing}"]
         ),
         &ctx
     ));
+    // The negated operator holds against it (cell E9b).
+    assert!(evaluate_condition(
+        &cond(
+            ConditionOperator::StringNotEquals,
+            "k",
+            vec!["${aws:PrincipalTag/Missing}"]
+        ),
+        &ctx
+    ));
 }
 
 #[test]
-fn policy_variable_naming_aws_tagkeys_is_left_literal() {
-    // A multivalued key has no single value to expand to. The condition value
-    // ${aws:TagKeys} is text that no tag key equals, so a Deny comparing
-    // aws:ResourceTag/team with it applies to no request, whichever tag key the
-    // request lists first. IAM answers the same (SimulateCustomPolicy,
-    // 2026-10-27).
+fn policy_variable_naming_aws_tagkeys_has_no_value() {
+    // A multivalued key has no single value to expand to, so a Deny comparing
+    // aws:ResourceTag/team with ${aws:TagKeys} applies to no request, whichever
+    // tag key the request lists first. IAM answers the same
+    // (SimulateCustomPolicy, 2026-10-27).
     let team_is_tag_keys = cond(
         ConditionOperator::StringEquals,
         "aws:ResourceTag/team",
@@ -318,15 +327,39 @@ fn policy_variable_naming_aws_tagkeys_is_left_literal() {
             "${{aws:TagKeys}} expanded for the keys {keys:?}"
         );
     }
-    // The variable is text, so it equals the same text.
-    let ctx = TestContext::new()
-        .with("aws:ResourceTag/team", vec!["${aws:TagKeys}"])
-        .with("aws:TagKeys", vec!["env", "owner"]);
-    assert!(evaluate_condition(&team_is_tag_keys, &ctx));
+    // The variable has no value whether aws:TagKeys holds two values, one or
+    // none, and its text is not compared: the positive operators are false
+    // against it and the negated ones true, even for a request value equal to
+    // the text. These are the rows measured with SimulateCustomPolicy on
+    // 2026-10-31 (in the description of PR #541).
+    for (tag_keys, env) in [
+        (Some(vec!["a", "b"]), "a"),
+        (Some(vec!["a", "b"]), "${aws:TagKeys}"),
+        (Some(vec!["a"]), "a"),
+        (None, "${aws:TagKeys}"),
+    ] {
+        let mut ctx = TestContext::new().with("aws:PrincipalTag/env", vec![env]);
+        if let Some(keys) = &tag_keys {
+            ctx = ctx.with("aws:TagKeys", keys.clone());
+        }
+        for (op, holds) in [
+            (ConditionOperator::StringEquals, false),
+            (ConditionOperator::StringLike, false),
+            (ConditionOperator::StringNotEquals, true),
+            (ConditionOperator::StringNotLike, true),
+        ] {
+            let c = cond(op.clone(), "aws:PrincipalTag/env", vec!["${aws:TagKeys}"]);
+            assert_eq!(
+                evaluate_condition(&c, &ctx),
+                holds,
+                "{op:?}, aws:TagKeys {tag_keys:?}, env {env}"
+            );
+        }
+    }
 }
 
 #[test]
-fn policy_variables_naming_the_dynamodb_multivalued_keys_are_left_literal() {
+fn policy_variables_naming_the_dynamodb_multivalued_keys_have_no_value() {
     for key in ["dynamodb:LeadingKeys", "dynamodb:Attributes"] {
         let variable = format!("${{{key}}}");
         let ctx = TestContext::new()

crates/auth/src/policy/condition/tests/three_case.rs

@@ -81,9 +81,10 @@ fn unresolvable_key_is_unresolvable_for_every_operator() {
 fn variable_naming_unresolvable_key_is_unresolvable_with_or_without_default() {
     // Case 3 read through a condition value: the variable has no value to
     // expand to, and the service, which has one, would not use the default.
-    // Every operator yields Unresolvable, so a Deny applies and an Allow does
-    // not grant whatever the operator says. A later value of the condition
-    // that names the key counts as the first one does.
+    // Every operator that expands the value (the string and ARN ones) yields
+    // Unresolvable, so a Deny applies and an Allow does not grant whatever the
+    // operator says. A later value of the condition that names the key counts
+    // as the first one does.
     let ctx = TestContext::new()
         .with("aws:PrincipalTag/team", vec!["blue"])
         .unresolvable("aws:PrincipalOrgID");

crates/auth/src/policy/context.rs

@@ -131,9 +131,11 @@ fn strip_prefix_ci<'a>(key: &'a str, prefix: &str) -> Option<&'a str> {
 ///
 /// Two places read the set, through `is_unresolvable_key`. A condition fails
 /// closed when its key is listed, or when one of its values names a listed key
-/// through a `${key}` or `${key, 'default'}` variable
-/// (`condition::evaluate_condition_match`). A `Resource` or `NotResource`
-/// pattern whose variable names a listed key fails closed in the same way
+/// through a `${key}` or `${key, 'default'}` variable in a `2012-10-17`
+/// document under a string or ARN operator, where the value is expanded
+/// (`condition::evaluate_condition_match`); a value that is not expanded
+/// reads no key. A `Resource` or `NotResource` pattern whose variable names a
+/// listed key fails closed in the same way
 /// (`variables::resource_pattern_is_unresolvable`). In both, a default written
 /// beside a listed key is not used, because the service would have a value
 /// for the key.

crates/auth/src/policy/context/request_tag_tests.rs

@@ -186,7 +186,8 @@ fn ambiguous_request_tag_as_a_policy_variable_fails_the_statement_closed() {
         ),
         ConditionMatch::Unresolvable
     );
-    // An absent request tag is not ambiguous: the variable stays literal, as before.
+    // An absent request tag is not ambiguous: with no default the variable has
+    // no value, so the value matches nothing.
     assert_eq!(
         evaluate_statement_conditions(&deny, true, &with_resource_tag(&[("team", "x")])),
         ConditionMatch::NoMatch
@@ -253,13 +254,14 @@ fn ambiguous_request_tag_as_a_defaulted_policy_variable_fails_the_statement_clos
 }
 
 #[test]
-fn policy_variable_naming_aws_tagkeys_is_left_literal_for_every_tag_order() {
+fn policy_variable_naming_aws_tagkeys_has_no_value_for_every_tag_order() {
     use crate::policy::condition::{ConditionMatch, evaluate_statement_conditions};
     use crate::policy::document::{Condition, ConditionOperator};
 
     // A Deny on aws:ResourceTag/team equal to ${aws:TagKeys} on a table tagged
-    // team=env. The variable names a multivalued key, so it stays literal and
-    // the statement applies to neither order of the request's tag keys.
+    // team=env. The variable names a multivalued key the request carries, so
+    // it has no value and the statement applies to neither order of the
+    // request's tag keys.
     let deny = [Condition {
         operator: ConditionOperator::StringEquals,
         key: "aws:ResourceTag/team".to_owned(),
@@ -306,36 +308,51 @@ fn assume_role_ctx(principal: &[(&str, &str)], session: &[(&str, &str)]) -> Assu
 }
 
 #[test]
-fn trust_policy_variable_naming_aws_tagkeys_is_left_literal() {
+fn trust_policy_variable_naming_aws_tagkeys_has_no_value() {
     use crate::policy::condition::{ConditionMatch, evaluate_statement_conditions};
     use crate::policy::document::{Condition, ConditionOperator};
 
     // AssumeRoleContext reports aws:TagKeys as multivalued, so a trust policy
-    // condition value ${aws:TagKeys} stays literal text. Expanded, it would be
-    // the first session tag key in the map's iteration order, which a test
-    // cannot choose. One context holds both session tag keys in one map, and
-    // each of its two principal tags holds one key, so an expansion to either
-    // key matches the condition on the principal tag that holds it.
-    let compare_with_tag_keys = |principal_tag: &str| {
+    // condition value ${aws:TagKeys} has no value: a positive operator is
+    // false against it and a negated one true, even for a principal tag that
+    // holds the variable's text. The IAM policy simulator gives these answers
+    // for an identity policy (2026-10-31, rows in the description of PR
+    // #541); the trust policy case was not measured. Expanded, it would be the
+    // first session tag key in the map's iteration order, which a test cannot
+    // choose. One context holds both session tag keys in one map, and each of
+    // its two principal tags holds one key, so an expansion to either key
+    // matches the condition on the principal tag that holds it.
+    let compare_with_tag_keys = |operator: ConditionOperator, principal_tag: &str| {
         [Condition {
-            operator: ConditionOperator::StringEquals,
+            operator,
             key: format!("aws:PrincipalTag/{principal_tag}"),
             values: vec!["${aws:TagKeys}".to_owned()],
         }]
     };
+    let equals = |tag: &str| compare_with_tag_keys(ConditionOperator::StringEquals, tag);
+    let not_equals = |tag: &str| compare_with_tag_keys(ConditionOperator::StringNotEquals, tag);
     let session = [("env", "x"), ("owner", "x")];
     let ctx = assume_role_ctx(&[("key_env", "env"), ("key_owner", "owner")], &session);
     for tag in ["key_env", "key_owner"] {
         assert_eq!(
-            evaluate_statement_conditions(&compare_with_tag_keys(tag), true, &ctx),
+            evaluate_statement_conditions(&equals(tag), true, &ctx),
             ConditionMatch::NoMatch,
             "${{aws:TagKeys}} expanded to the session tag key in {tag}"
         );
+        assert_eq!(
+            evaluate_statement_conditions(&not_equals(tag), true, &ctx),
+            ConditionMatch::Match,
+            "${{aws:TagKeys}} expanded to the session tag key in {tag}"
+        );
     }
-    // The variable is text, so it equals the same text.
+    // The variable's text is not compared.
     let ctx = assume_role_ctx(&[("team", "${aws:TagKeys}")], &session);
     assert_eq!(
-        evaluate_statement_conditions(&compare_with_tag_keys("team"), true, &ctx),
+        evaluate_statement_conditions(&equals("team"), true, &ctx),
+        ConditionMatch::NoMatch
+    );
+    assert_eq!(
+        evaluate_statement_conditions(&not_equals("team"), true, &ctx),
         ConditionMatch::Match
     );
 }

crates/auth/src/policy/document.rs

@@ -209,7 +209,7 @@ impl PolicyDocument {
 
 /// Unwrap a condition operator to its base, dropping any `ForAllValues:` /
 /// `ForAnyValue:` prefix and `IfExists` suffix.
-fn base_operator(op: &ConditionOperator) -> &ConditionOperator {
+pub(super) fn base_operator(op: &ConditionOperator) -> &ConditionOperator {
     match op {
         ConditionOperator::ForAllValues(inner)
         | ConditionOperator::ForAnyValue(inner)

crates/auth/src/policy/evaluator.rs

@@ -235,8 +235,9 @@ fn resource_matches(
 }
 
 /// Outcome of a statement's `Condition` block, three-valued. `policy` is the
-/// statement's document: its `Version` decides how the condition values read
-/// policy variables (`condition::evaluate_condition_with`).
+/// statement's document: its `Version` decides whether the condition values
+/// expand policy variables, which only a `2012-10-17` document does
+/// (`condition::evaluate_condition_with`).
 fn statement_conditions(
     policy: &PolicyDocument,
     statement: &Statement,

crates/auth/src/policy/evaluator/tests.rs

@@ -60,6 +60,10 @@ fn parse(json: &str) -> PolicyDocument {
 mod case_three;
 mod combined;
 mod condition_variable_scope;
+mod condition_variables;
+mod condition_variables_arn;
+mod condition_variables_arn_context;
+mod condition_variables_operators;
 mod core;
 mod empty_values;
 mod resource_variables;