Question: How can an AWS IAM policy be devised to differentiate between a console (web) and access key (API) access?

Use Case: Say, I want to allow the a certain group of users full IAM privileges via console(web), and read only IAM via access key (API).

The specific use case is that I trust some AWS users with full IAM privileges, as they have 2fa for console access. They dont practice 2fa for access key access, and it is significantly easier to misuse. Yet they still need some (read) access key (API) access, as they employ auditing tools and often use CLI.

Progress: The condition component in an AWS IAM policy looks promising, i've been able to use it effectively to enforce the use of IAM;

"Condition": {
                "BoolIfExists": {
                    "aws:MultiFactorAuthPresent": "false"

But I could not find any relevant conditions which AWS support to account for differentiating between console and access key access.


1 Answer 1


Apparently I can't.

AWS does not differentiate between access key and console password authentication. There are some temporary credentials and 2FA IAM policy conditions, but they do not fit our use case.

One can use some IAM conditions to fit my or similar use cases, but not the way I planned;

  • the UserAgent condition to differentiate between cli, browser and sdk users. BUT BE WARNED, it can EASILY be tampered with, this is NOT an airtight control.
  • the sourceVpc condition (apply a global 2FA policy and exclude anything from your VPC, that way applications running with AWS IAM user access keys aren't disrupted. Yet I know they shouldn't be, but they are);

"Condition": { "StringNotEquals": { "aws:sourceVpc": "vpc-111bbb22" } }

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .