Null

checks if a context key is absent in the request. If the policy value is "true", the key must not exist in the request. If the policy value is "false", the key must exist in the request. Yes, it's that not-unconfusing.

You can NOT use policy variables in the value of this operator.

Null in an Allow Statement

Simulate in IAM Simulate

Policy Condition	Request Context	Result
"Null": { "aws:TokenIssueTime": "true" }	`aws:TokenIssueTime: null`	✓ Allowed Assuming no explicit Deny elsewhere
"Null": { "aws:TokenIssueTime": "true" }	`aws:TokenIssueTime: 2011-05-03T00:00:00Z`	− Not Allowed Statement does not apply
"Null": { "aws:TokenIssueTime": "false" }	`aws:TokenIssueTime: null`	− Not Allowed Statement does not apply
"Null": { "aws:TokenIssueTime": "false" }	`aws:TokenIssueTime: 2011-05-03T00:00:00Z`	✓ Allowed Assuming no explicit Deny elsewhere

Null in a Deny Statement

Simulate in IAM Simulate

Policy Condition	Request Context	Result
"Null": { "aws:TokenIssueTime": "true" }	`aws:TokenIssueTime: null`	✕ Denied
"Null": { "aws:TokenIssueTime": "true" }	`aws:TokenIssueTime: 2011-05-03T00:00:00Z`	− Not Denied May be allowed by another statement
"Null": { "aws:TokenIssueTime": "false" }	`aws:TokenIssueTime: null`	− Not Denied May be allowed by another statement
"Null": { "aws:TokenIssueTime": "false" }	`aws:TokenIssueTime: 2011-05-03T00:00:00Z`	✕ Denied

Null

Null in an Allow Statement

Null in a Deny Statement

See Act in your environment