iam-policy-validator 1.15.0__tar.gz → 1.15.1__tar.gz

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/CHANGELOG.md

@@ -8,18 +8,93 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Planned
-- NotAction/NotResource validation support
+
 - Enhanced PR comment management with configurable limits
 
 ---
 
+## [1.15.0] - 2025-01-22
+
+### Added
+
+**MCP Server Integration**
+
+- Full FastMCP server with 25+ tools for AI assistants (`iam-validator mcp` command)
+- Standalone `iam-validator-mcp` entry point for easy integration
+- Policy validation, generation, and AWS service querying tools
+- 15 built-in secure policy templates for common use cases
+- Session-wide organization configuration management
+- MCP Prompts for guided workflows (generate_secure_policy, fix_policy_issues_workflow, review_policy_security)
+- Custom instructions support via YAML config, environment variable, CLI, or MCP tools
+- Comprehensive MCP documentation with usage examples
+
+**New Security Check**
+
+- `not_action_not_resource` check for detecting dangerous NotAction/NotResource patterns (high severity)
+
+**Query Command Enhancements**
+
+- Support multiple actions in single query (`--name s3:GetObject dynamodb:Query`)
+- Wildcard pattern expansion (`--name "iam:Get*"` or `--name "s3:*Object*"`)
+- Field filter options: `--show-condition-keys`, `--show-resource-types`, `--show-access-level`
+- Allow service prefix in `--name`, making `--service` optional (`--name s3:GetObject`)
+- Deduplicate results when querying overlapping patterns
+
+**Validation Improvements**
+
+- `action_validation` now validates wildcard patterns (e.g., `s3:Get*`) to ensure they match real AWS actions
+- `action_validation` now validates NotAction field
+- `resource_validation` now validates NotResource field
+- `wildcard_resource` check has condition-aware severity adjustment:
+  - MEDIUM → LOW when global resource-scoping conditions present (aws:ResourceAccount, aws:ResourceOrgID, aws:ResourceOrgPaths)
+  - MEDIUM → LOW when aws:ResourceTag/\* conditions are used AND all actions support the condition key
+
+**Configuration**
+
+- Add `hide_severities` option for severity-based finding filtering (global and per-check)
+- Add `iam-policy-validator` CLI alias matching PyPI package name
+
+**Cache Improvements**
+
+- Cache refresh now updates all cached services (not just common ones)
+- Expired cache files are kept for refresh instead of deleted
+- Stale cache fallback when AWS API fails for graceful degradation
+
+**SDK**
+
+- Export `extract_condition_keys_from_statement()` in public API
+- Add `is_condition_key_supported()` to AWSServiceFetcher
+
+### Changed
+
+- Development status upgraded to Production/Stable
+- Batch operations use `asyncio.gather()` for parallel execution
+- Template listing includes full variable metadata (name, description, required)
+- Simplified condition key pattern matching for tag-key placeholders (forward-compatible)
+- Test suite consolidated using `@pytest.mark.parametrize` (919 → 850 tests)
+
+### Fixed
+
+- Support parameterized condition key patterns like `s3:RequestObjectTag/<key>`
+- MCP tests skip properly when fastmcp is not installed
+- Improved loop prevention guidance for LLM clients
+
+### Dependencies
+
+- fastmcp as optional dependency (install with `[mcp]` extra)
+- Updated CI dependencies (actions/cache, codeql-action, setup-uv, upload-pages-artifact)
+
+---
+
 ## [1.14.7] - 2025-12-17
 
 ### Added
+
 - MkDocs documentation site deployed to GitHub Pages
 - Comprehensive SDK API reference documentation
 
 ### Fixed
+
 - Correct repository name in all documentation links (iam-policy-auditor → iam-policy-validator)
 - Fix SDK docstring formatting for proper mkdocstrings rendering
 - Update PyPI metadata with correct documentation and changelog URLs
@@ -29,6 +104,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.6] - 2025-12-15
 
 ### Fixed
+
 - Separate security findings from validity errors in PR comments
 - Respect ignored findings when managing PR labels and review state
 
@@ -37,6 +113,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.5] - 2025-12-15
 
 ### Fixed
+
 - Respect ignored findings when managing PR labels and review state
 
 ---
@@ -44,6 +121,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.4] - 2025-12-12
 
 ### Fixed
+
 - Show pass status and list ignored findings in summary when all blocking issues are ignored
 
 ---
@@ -51,6 +129,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.3] - 2025-12-12
 
 ### Fixed
+
 - Add pattern matching for service-specific condition keys with tag validation
 
 ---
@@ -58,6 +137,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.2] - 2025-12-12
 
 ### Fixed
+
 - Use APPROVE review event when validation passes to dismiss REQUEST_CHANGES
 
 ---
@@ -65,10 +145,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.1] - 2025-12-11
 
 ### Fixed
+
 - Enhanced SARIF formatter with dynamic rules and rich context
 - Improved finding fingerprints for better PR comment deduplication
 
 ### Changed
+
 - Updated dependencies (setup-uv, actions/checkout, codeql-action)
 
 ---
@@ -76,11 +158,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.14.0] - 2024-12-10
 
 ### Added
+
 - Enhanced PR comments with fingerprint-based matching
 - Finding ignore system via PR comment replies
 - Improved review comment deduplication
 
 ### Changed
+
 - Better production readiness for GitHub Action integration
 
 ---
@@ -88,6 +172,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.13.1] - 2024-12
 
 ### Fixed
+
 - Bug fixes and stability improvements
 
 ---
@@ -95,6 +180,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.13.0] - 2024-12
 
 ### Added
+
 - Query command for exploring AWS service definitions
 - Shell completion support (bash, zsh, fish)
 
@@ -103,10 +189,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.12.0] - 2024-11
 
 ### Added
+
 - Trust policy validation check
 - Enhanced condition type mismatch detection
 
 ### Changed
+
 - Improved AWS service fetcher performance
 
 ---
@@ -114,10 +202,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.11.0] - 2024-11
 
 ### Added
+
 - Action-resource matching validation
 - Set operator validation for conditions (ForAllValues/ForAnyValue)
 
 ### Changed
+
 - Expanded sensitive actions database (490+ actions)
 
 ---
@@ -125,10 +215,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.10.0] - 2024-10
 
 ### Added
+
 - MFA condition check for sensitive operations
 - Condition key validation improvements
 
 ### Changed
+
 - Better error messages for validation failures
 
 ---
@@ -136,6 +228,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.9.0] - 2024-10
 
 ### Added
+
 - GitHub PR review comments (inline comments on changed lines)
 - Multiple output formats (JSON, SARIF, CSV, HTML, Markdown)
 
@@ -144,6 +237,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.8.0] - 2024-09
 
 ### Added
+
 - AWS Access Analyzer integration
 - Offline validation mode with pre-downloaded service definitions
 
@@ -152,10 +246,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.7.0] - 2024-09
 
 ### Added
+
 - Custom checks support via `--custom-checks-dir`
 - Configuration file support (`iam-validator.yaml`)
 
 ### Changed
+
 - Modular check architecture
 
 ---
@@ -163,6 +259,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.6.0] - 2024-08
 
 ### Added
+
 - Service Control Policy (SCP) validation
 - Principal validation for resource policies
 
@@ -171,17 +268,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.5.0] - 2024-08
 
 ### Added
+
 - Modular Python configuration system (5-10x faster startup)
 - Split security checks into individual modules:
-  - `wildcard_action` - Wildcard actions (Action: "*")
-  - `wildcard_resource` - Wildcard resources (Resource: "*")
-  - `service_wildcard` - Service-level wildcards (e.g., "s3:*")
+  - `wildcard_action` - Wildcard actions (Action: "\*")
+  - `wildcard_resource` - Wildcard resources (Resource: "\*")
+  - `service_wildcard` - Service-level wildcards (e.g., "s3:\*")
   - `sensitive_action` - Sensitive actions without conditions
-  - `full_wildcard` - Action:* + Resource:* (critical)
+  - `full_wildcard` - Action:_ + Resource:_ (critical)
 - GitHub Action RESOURCE_CONTROL_POLICY support
 - GitHub Actions job summary output
 
 ### Changed
+
 - Comprehensive documentation overhaul
 
 ---
@@ -189,9 +288,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.4.0] - 2024-07
 
 ### Added
+
 - Resource Control Policy (RCP) support with 8 validation checks
 - Enhanced principal validation:
-  - Blocked principals (e.g., public access "*")
+  - Blocked principals (e.g., public access "\*")
   - Allowed principals whitelist
   - Required conditions for specific principals
   - Service principal validation
@@ -203,6 +303,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.3.0] - 2024-06
 
 ### Added
+
 - Modular Python configuration system
 - Condition requirement templates
 - Action condition enforcement check
@@ -212,6 +313,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.2.0] - 2024-05
 
 ### Added
+
 - Smart IAM policy detection and filtering
 - YAML policy support
 - Streaming mode for large policy sets
@@ -221,6 +323,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.1.0] - 2024-04
 
 ### Added
+
 - Split security checks into individual modules
 - Configurable check system
 - Per-check severity overrides
@@ -230,6 +333,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [1.0.0] - 2024-03
 
 ### Added
+
 - Initial release
 - Core IAM policy validation engine
 - AWS service definition fetching with caching
@@ -249,11 +353,11 @@ This project follows [Semantic Versioning](https://semver.org/):
 
 ### Supported Versions
 
-| Version | Support Status        |
-| ------- | --------------------- |
-| 1.14.x  | ✅ Active development  |
-| 1.13.x  | ⚠️ Critical fixes only |
-| < 1.13  | ❌ End of life         |
+| Version | Support Status         |
+| ------- | ---------------------- |
+| 1.15.x  | ✅ Active development  |
+| 1.14.x  | ⚠️ Critical fixes only |
+| < 1.14  | ❌ End of life         |
 
 ### Deprecation Policy
 
@@ -270,6 +374,7 @@ This project follows [Semantic Versioning](https://semver.org/):
 The modular configuration system introduced in v1.5.0 changed how checks are configured:
 
 **Before (v1.4.x):**
+
 ```yaml
 checks:
   wildcard: high
@@ -277,6 +382,7 @@ checks:
 ```
 
 **After (v1.5.0+):**
+
 ```yaml
 wildcard_action:
   enabled: true
@@ -298,7 +404,9 @@ iam-validator validate --policy-type RESOURCE_CONTROL_POLICY policies/
 
 ---
 
-[Unreleased]: https://github.com/boogy/iam-policy-validator/compare/v1.14.6...HEAD
+[Unreleased]: https://github.com/boogy/iam-policy-validator/compare/v1.15.0...HEAD
+[1.15.0]: https://github.com/boogy/iam-policy-validator/compare/v1.14.7...v1.15.0
+[1.14.7]: https://github.com/boogy/iam-policy-validator/compare/v1.14.6...v1.14.7
 [1.14.6]: https://github.com/boogy/iam-policy-validator/compare/v1.14.5...v1.14.6
 [1.14.5]: https://github.com/boogy/iam-policy-validator/compare/v1.14.4...v1.14.5
 [1.14.4]: https://github.com/boogy/iam-policy-validator/compare/v1.14.3...v1.14.4

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.15.0
+Version: 1.15.1
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.15.0"
+__version__ = "1.15.1"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/iam_validator/core/aws_service/validators.py

@@ -243,22 +243,30 @@ class ServiceValidator:
             _, action_name = self._parser.parse_action(action)
 
             # Check if it's a global condition key
+            # Note: Some aws: prefixed keys like aws:RequestTag/* and aws:ResourceTag/* are NOT
+            # global keys - they're action-specific or resource-specific. We'll check those later.
             is_global_key = False
             if condition_key.startswith("aws:"):
                 global_conditions = get_global_conditions()
                 if global_conditions.is_valid_global_key(condition_key):
                     is_global_key = True
-                else:
-                    return ConditionKeyValidationResult(
-                        is_valid=False,
-                        error_message=f"Invalid AWS global condition key: `{condition_key}`.",
-                    )
+                # If not a global key, continue to check action/resource-specific keys
+                # Don't return an error yet - aws:RequestTag, aws:ResourceTag are action-specific
 
             # Check service-specific condition keys (with pattern matching for tag keys)
-            if service_detail.condition_keys and condition_key_in_list(
-                condition_key, list(service_detail.condition_keys.keys())
-            ):
-                return ConditionKeyValidationResult(is_valid=True)
+            # IMPORTANT: aws:RequestTag and aws:ResourceTag patterns in service-level keys
+            # are NOT universally valid for all actions. Skip them here - they'll be checked
+            # at action/resource level.
+            if service_detail.condition_keys:
+                # Check if it matches service-level keys, but exclude RequestTag/ResourceTag
+                if condition_key_in_list(condition_key, list(service_detail.condition_keys.keys())):
+                    # If it's RequestTag or ResourceTag, don't return valid here - check action/resource level
+                    if not (
+                        condition_key.startswith("aws:RequestTag/")
+                        or condition_key.startswith("aws:ResourceTag/")
+                    ):
+                        return ConditionKeyValidationResult(is_valid=True)
+                    # For RequestTag/ResourceTag, continue to check action/resource level
 
             # Check action-specific condition keys
             if action_name in service_detail.actions:
@@ -298,8 +306,26 @@ class ServiceValidator:
             if is_global_key:
                 return ConditionKeyValidationResult(is_valid=True)
 
-            # Short error message
-            error_msg = f"Condition key `{condition_key}` is not valid for action `{action}`"
+            # If we reach here, the condition key was not found in any valid location
+            # Check if it's an aws: prefixed key that's not global - provide specific error
+            if condition_key.startswith("aws:"):
+                # Special handling for aws:RequestTag and aws:ResourceTag patterns
+                if condition_key.startswith("aws:RequestTag/"):
+                    error_msg = (
+                        f"Condition key `{condition_key}` is not supported by action `{action}`. "
+                        f"The `aws:RequestTag/${{TagKey}}` condition is only supported by actions that "
+                        f"create or modify resources with tags. This action does not support tag operations."
+                    )
+                elif condition_key.startswith("aws:ResourceTag/"):
+                    error_msg = (
+                        f"Condition key `{condition_key}` is not supported by the resources used by action `{action}`. "
+                        f"The `aws:ResourceTag/${{TagKey}}` condition is only supported by resources that have tags."
+                    )
+                else:
+                    error_msg = f"Invalid AWS condition key: `{condition_key}`. This key is not a valid global condition key and is not supported by action `{action}`."
+            else:
+                # Short error message for non-aws: keys
+                error_msg = f"Condition key `{condition_key}` is not valid for action `{action}`"
 
             # Collect valid condition keys for this action
             valid_keys: set[str] = set()

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/iam_validator/core/config/aws_global_conditions.py

@@ -85,17 +85,13 @@ GLOBAL_RESOURCE_SCOPING_CONDITION_KEYS = frozenset(
 )
 
 # Patterns that should be recognized (wildcards and tag-based keys)
-# These allow things like aws:RequestTag/Department or aws:PrincipalTag/Environment
+# IMPORTANT: aws:RequestTag and aws:ResourceTag are NOT global condition keys!
+# They are action-specific or resource-specific and must be explicitly listed in
+# the action's ActionConditionKeys or the resource's ConditionKeys.
+# Only aws:PrincipalTag is a true global condition key.
+#
 # Uses centralized tag key character class from constants
 AWS_CONDITION_KEY_PATTERNS = [
-    {
-        "pattern": rf"^aws:RequestTag/[{AWS_TAG_KEY_ALLOWED_CHARS}]+$",
-        "description": "Tag keys in the request (for tag-based access control)",
-    },
-    {
-        "pattern": rf"^aws:ResourceTag/[{AWS_TAG_KEY_ALLOWED_CHARS}]+$",
-        "description": "Tags on the resource being accessed",
-    },
     {
         "pattern": rf"^aws:PrincipalTag/[{AWS_TAG_KEY_ALLOWED_CHARS}]+$",
         "description": "Tags attached to the principal making the request",

{iam_policy_validator-1.15.0 → iam_policy_validator-1.15.1}/tests/checks/test_aws_global_conditions.py

@@ -40,19 +40,21 @@ class TestAWSGlobalConditions:
         assert conditions.is_valid_global_key("") is False
 
     def test_request_tag_pattern(self, conditions):
-        """Test validation of aws:RequestTag/* patterns."""
-        assert conditions.is_valid_global_key("aws:RequestTag/Environment") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/Owner") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/CostCenter") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/Team-Name") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/app.example.com/role") is True
+        """Test that aws:RequestTag/* are NOT global keys (they're action-specific)."""
+        # aws:RequestTag is NOT a global key - it's only supported by specific actions
+        assert conditions.is_valid_global_key("aws:RequestTag/Environment") is False
+        assert conditions.is_valid_global_key("aws:RequestTag/Owner") is False
+        assert conditions.is_valid_global_key("aws:RequestTag/CostCenter") is False
+        assert conditions.is_valid_global_key("aws:RequestTag/Team-Name") is False
+        assert conditions.is_valid_global_key("aws:RequestTag/app.example.com/role") is False
 
     def test_resource_tag_pattern(self, conditions):
-        """Test validation of aws:ResourceTag/* patterns."""
-        assert conditions.is_valid_global_key("aws:ResourceTag/Environment") is True
-        assert conditions.is_valid_global_key("aws:ResourceTag/Owner") is True
-        assert conditions.is_valid_global_key("aws:ResourceTag/Project") is True
-        assert conditions.is_valid_global_key("aws:ResourceTag/app:component") is True
+        """Test that aws:ResourceTag/* are NOT global keys (they're resource-specific)."""
+        # aws:ResourceTag is NOT a global key - it's only supported by resources that have tags
+        assert conditions.is_valid_global_key("aws:ResourceTag/Environment") is False
+        assert conditions.is_valid_global_key("aws:ResourceTag/Owner") is False
+        assert conditions.is_valid_global_key("aws:ResourceTag/Project") is False
+        assert conditions.is_valid_global_key("aws:ResourceTag/app:component") is False
 
     def test_principal_tag_pattern(self, conditions):
         """Test validation of aws:PrincipalTag/* patterns."""
@@ -95,11 +97,13 @@ class TestAWSGlobalConditions:
         assert conditions.get_key_type("aws:MultiFactorAuthAge") == "Numeric"
         assert conditions.get_key_type("aws:username") == "String"
 
-        # Pattern matches (tags) - all tag keys are String type
-        assert conditions.get_key_type("aws:RequestTag/Environment") == "String"
-        assert conditions.get_key_type("aws:ResourceTag/Name") == "String"
+        # Pattern matches (only PrincipalTag is global) - all tag keys are String type
         assert conditions.get_key_type("aws:PrincipalTag/Department") == "String"
 
+        # RequestTag and ResourceTag are NOT global
+        assert conditions.get_key_type("aws:RequestTag/Environment") is None
+        assert conditions.get_key_type("aws:ResourceTag/Name") is None
+
         # Invalid keys
         assert conditions.get_key_type("invalid:key") is None
         assert conditions.get_key_type("s3:prefix") is None
@@ -108,7 +112,7 @@ class TestAWSGlobalConditions:
         """Test getting all condition key patterns."""
         patterns = conditions.get_patterns()
         assert isinstance(patterns, list)
-        assert len(patterns) == 3  # RequestTag, ResourceTag, PrincipalTag
+        assert len(patterns) == 1  # Only PrincipalTag (RequestTag and ResourceTag are NOT global)
 
         # Verify pattern structure
         for pattern_config in patterns:
@@ -117,7 +121,7 @@ class TestAWSGlobalConditions:
 
         # Ensure it's a copy, not the original
         patterns.append({"pattern": "test", "description": "test"})
-        assert len(conditions._patterns) == 3
+        assert len(conditions._patterns) == 1
 
     def test_singleton_get_global_conditions(self):
         """Test the singleton factory function."""
@@ -146,14 +150,18 @@ class TestAWSGlobalConditions:
     def test_tag_with_special_characters(self, conditions):
         """Test tag patterns with allowed special characters."""
         # According to the pattern: [a-zA-Z0-9+\-=._:/@]+
-        assert conditions.is_valid_global_key("aws:RequestTag/my-tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my_tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my.tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my:tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my/tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my@tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my+tag") is True
-        assert conditions.is_valid_global_key("aws:RequestTag/my=tag") is True
+        # Only PrincipalTag is global, so test with it
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my-tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my_tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my.tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my:tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my/tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my@tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my+tag") is True
+        assert conditions.is_valid_global_key("aws:PrincipalTag/my=tag") is True
+
+        # RequestTag is NOT global
+        assert conditions.is_valid_global_key("aws:RequestTag/my-tag") is False
 
     def test_known_service_specific_keys_are_invalid(self, conditions):
         """Test that service-specific condition keys are not treated as global."""