S3 Tables and Vector Bucket security: policy condition validation and fail-safe stored policies

S3-Tables-Security.md

@@ -36,6 +36,23 @@ A policy document consists of a list of statements:
 - **Resource**: The resource ARN (supports wildcards).
 - **Condition**: (Optional) extra conditions for the rule.
 
+### Policy validation
+
+`PutTableBucketPolicy` and `PutTablePolicy` refuse a policy with a condition that could not be enforced, answering `400 InvalidRequest`:
+
+| Policy content | Message |
+|----------------|---------|
+| An unsupported condition operator, e.g. `StringEqualsIfExists` | `condition operator "StringEqualsIfExists" is not supported` |
+| An operator with no keys, e.g. `"StringEquals": {}` | `condition StringEquals needs at least one key` |
+| A condition key the server never supplies, e.g. `aws:SourceIp` | `condition key "aws:SourceIp" is not supported in a table policy` |
+| A value the operator cannot read: `null`, an object, an empty list, `NaN` or `±Inf`; a non-number for `Numeric*`, a non-RFC 3339 time for `Date*`, anything but `true`/`false` for `Bool` and `Null`, a non-IP/CIDR for `IpAddress` | `condition NumericLessThan on "..." needs values NumericLessThan can read (...)` |
+| An Allow whose `Condition` is `null` | `an Allow statement's Condition must not be null` |
+| A `Condition` written twice in one statement, or under two spellings (`Condition` and `condition`) | `a statement's Condition must be under one key, spelled Condition` |
+
+Supported condition keys: `s3tables:namespace`, `s3tables:tableName`, `s3tables:tableBucketName`, `s3tables:SSEAlgorithm`, `s3tables:KMSKeyArn`, `s3tables:StorageClass`, `aws:TagKeys`, and the tag keys `aws:RequestTag/<key>`, `aws:ResourceTag/<key>`, `s3tables:TableBucketTag/<key>`, `s3vectors:VectorBucketTag/<key>`.
+
+Policies stored by an earlier version that contain such a condition fail safe: an Allow statement with one never grants, and a Deny statement with one always applies. The server logs a warning naming the resource ARN.
+
 ---
 
 ## Supported Actions

S3-Vector-Bucket-Security.md

@@ -161,5 +161,10 @@ A `Deny` with a tag condition protects the resources carrying the tag. This stat
 | `NotResource` | `NotResource is not supported` |
 | A condition on a key other than those under [Tag conditions](#tag-conditions), e.g. `aws:SourceIp` | `condition key "aws:SourceIp" is not supported in a vector bucket policy` |
 | An unsupported condition operator, e.g. `StringEqualsIfExists` | `condition operator "StringEqualsIfExists" is not supported` |
-| A condition value that is `null`, an object or an empty list | `condition StringEquals on "aws:ResourceTag/env" needs a string, number or boolean, or a non-empty list of them` |
-| A condition field not spelled `Condition`, e.g. `condition` | `condition must be spelled Condition` |
+| An operator with no keys, e.g. `"StringEquals": {}` | `condition StringEquals needs at least one key` |
+| A value the operator cannot read: `null`, an object, an empty list, `NaN` or `±Inf`; a non-number for `Numeric*`, a non-RFC 3339 time for `Date*`, anything but `true`/`false` for `Bool` and `Null`, a non-IP/CIDR for `IpAddress` | `condition StringEquals on "aws:ResourceTag/env" needs values StringEquals can read (...)` |
+| An Allow whose `Condition` is `null` | `an Allow statement's Condition must not be null` |
+| `Statement`, `Effect` or `Condition` not spelled exactly that, e.g. `condition` | `condition must be spelled Condition` |
+| A `Condition` written twice in one statement | `a statement's Condition must be under one key` |
+
+Policies stored by an earlier version that contain an unusable condition fail safe: an Allow statement with one never grants, and a Deny statement with one always applies.