# IAM ForAllValues Condition Evaluation Pitfalls and How to Avoid Them

> Learn about IAM ForAllValues condition evaluation pitfalls and how to avoid them. Discover how to prevent unintended access by enforcing key presence with Null conditions.

- Repository: [Amazon Web Services/agent-toolkit-for-aws](https://github.com/aws/agent-toolkit-for-aws)
- Tags: best-practices
- Published: 2026-06-29

---

**When an IAM policy uses `ForAllValues:StringEquals`, missing or empty context keys evaluate to true by default, potentially allowing unintended access unless you add a `Null` condition to enforce key presence.**

The `aws/agent-toolkit-for-aws` repository documents critical security behaviors in AWS IAM policy conditions. Understanding **IAM ForAllValues condition evaluation** is essential because the default behavior for missing keys can silently bypass your intended restrictions. This guide explains the vacuous truth problem and the specific guard clause required to fix it, based on the official IAM skill documentation.

## Understanding the Vacuous Truth Problem

When you use a **ForAllValues** condition operator like `ForAllValues:StringEquals`, the policy engine checks that *every* element in the request context matches your specified values. However, if the context key referenced in the condition is **absent or empty**, the condition evaluates to **true**—a logical case known as *vacuous truth*.

According to the source documentation in [`skills/core-skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-iam/SKILL.md) (lines 53-68), this behavior means that requests omitting the context key entirely may pass your security controls unintentionally. The same warning appears in the plugin version at [`plugins/aws-core/skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-iam/SKILL.md) (lines 53-68).

## The Mandatory Null Condition Guard

To prevent vacuous truth from bypassing your restrictions, you must add a **`Null`** condition on the same context key, explicitly requiring the key to be present and non-null. Set the `Null` condition value to `"false"` to force the policy engine to reject requests where the key is missing.

This combination ensures that:
- The `ForAllValues` logic applies only when the key actually exists
- Requests without the context key are explicitly denied
- Empty lists fail the `Null` check (since `"false"` requires a non-null value)

## Practical Implementation Examples

### The Risky Policy (Vacuous Truth Exposure)

The following policy allows `ec2:RunInstances` only if all tag keys are either "Alpha" or "Beta". However, if the request omits `aws:TagKeys` entirely, the condition vacuously evaluates to true and allows the action:

```json
{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": "*",
    "Condition": {
      "ForAllValues:StringEquals": {
        "aws:TagKeys": ["Alpha", "Beta"]
      }
    }
  }
}

```

### The Secured Policy (With Null Guard)

Adding the `Null` condition forces the request to include `aws:TagKeys` with at least one value. If the key is missing or null, the `Null` condition fails and denies access:

```json
{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Action": "ec2:RunInstances",
    "Resource": "*",
    "Condition": {
      "ForAllValues:StringEquals": {
        "aws:TagKeys": ["Alpha", "Beta"]
      },
      "Null": {
        "aws:TagKeys": "false"
      }
    }
  }
}

```

### Syntax Breakdown

The `"Null": {"aws:TagKeys": "false"}` construct tells IAM that the key must **not** be null. When combined with `ForAllValues`, this creates a two-layer validation:

1. **Presence check**: The `Null` condition confirms the key exists and contains values
2. **Value check**: The `ForAllValues` condition validates that every provided value matches your allowed list

## Source Code Reference

This guidance originates from the AWS agent toolkit's IAM skill documentation:

- **Primary documentation**: [`skills/core-skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-iam/SKILL.md) (lines 53-68) contains the authoritative explanation of the vacuous truth issue and the recommended `Null` condition fix.
- **Plugin mirror**: [`plugins/aws-core/skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-iam/SKILL.md) (lines 53-68) duplicates the same content for plugin implementations.

Both files provide the JSON examples and detailed explanations that form the basis of this security best practice.

## Summary

- **`ForAllValues` evaluates to true** when the context key is missing or empty due to vacuous truth logic
- **Always pair `ForAllValues` with a `Null` condition** set to `"false"` on the same key to enforce presence
- **Validate tag-based policies** carefully, as `aws:TagKeys` is frequently omitted in API requests
- **Reference the source files** at [`skills/core-skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-iam/SKILL.md) for the complete implementation guidance

## Frequently Asked Questions

### What happens if aws:TagKeys is missing in a ForAllValues condition?

The condition evaluates to **true**, potentially allowing unintended access. When the context key is absent, the "for all values" statement is vacuously satisfied because there are no values to compare against your restrictions.

### Why does ForAllValues return true for empty sets?

This follows the logical principle of **vacuous truth**. In IAM policy evaluation, asserting that "all values match X" is considered true when there are zero values to check, similar to how "all unicorns are blue" is logically true if no unicorns exist.

### How do I force IAM to check for key presence?

Add a **`Null` condition** with a value of `"false"` on the same context key. This explicitly requires the key to be present and non-null, preventing the vacuous truth scenario from bypassing your security controls.

### Where is this documented in the AWS agent toolkit?

The documentation appears in [`skills/core-skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/skills/core-skills/aws-iam/SKILL.md) at lines 53-68, with identical content mirrored in [`plugins/aws-core/skills/aws-iam/SKILL.md`](https://github.com/aws/agent-toolkit-for-aws/blob/main/plugins/aws-core/skills/aws-iam/SKILL.md) at lines 53-68. These files contain the authoritative JSON examples and explanations for implementing safe `ForAllValues` conditions.