iam-policy-validator 1.15.6__tar.gz → 1.16.0__tar.gz

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/.github/workflows/ci.yml

@@ -26,7 +26,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 
@@ -56,7 +56,7 @@ jobs:
           python-version: ${{ matrix.python-version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 
@@ -80,7 +80,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 
@@ -104,7 +104,7 @@ jobs:
           python-version: "${{ env.DEFAULT_PYTHON_VERSION }}"
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/.github/workflows/pre-release.yml

@@ -80,7 +80,7 @@ jobs:
           python-version: ${{ inputs.python_version }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/.github/workflows/release.yml

@@ -31,7 +31,7 @@ jobs:
           python-version: ${{ env.PYTHON_VERSION }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
         with:
           enable-cache: true
 

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/CHANGELOG.md

@@ -13,6 +13,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.16.0] - 2026-02-05
+
+### Added
+
+- New `ifexists_condition_usage` check validating proper usage of the `IfExists` suffix on condition operators:
+  - Detects `IfExists` on security-sensitive keys in Allow statements (may bypass controls)
+  - Warns about non-negated `IfExists` weakening Deny statements
+  - Flags redundant `IfExists` on always-present keys (e.g., `aws:SecureTransport`)
+  - Optionally suggests `IfExists` for negated operators in Deny statements
+- Security-sensitive and always-present condition key constants in `condition_validators` module
+
+### Improved
+
+- `condition_key_validation`: Suppress false positive errors when `IfExists` is used with keys valid for some but not all actions in the statement
+- `condition_type_mismatch`: Detect `NullIfExists` as invalid syntax (the `Null` operator already checks for key existence)
+- `set_operator_validation`: Compound warning when `ForAllValues` is combined with `IfExists` (doubly permissive pattern)
+
+---
+
 ## [1.15.5] - 2025-01-28
 
 ### Fixed

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.15.6
+Version: 1.16.0
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://boogy.github.io/iam-policy-validator

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/action.yaml

@@ -183,7 +183,7 @@ runs:
         python-version-file: "${{ github.action_path }}/.python-version"
 
     - name: Install uv
-      uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b # v7.2.0
+      uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
       with:
         enable-cache: true
         cache-suffix: ci # Prune cache in CI to reduce bloat
@@ -211,7 +211,7 @@ runs:
 
     - name: Restore AWS service definitions cache
       id: cache-aws-services
-      uses: actions/cache/restore@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+      uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cache/iam-validator/aws_services
         # Cache key refreshes weekly to get latest AWS service updates
@@ -553,7 +553,7 @@ runs:
       # Attempting to save with an existing key will silently do nothing
       # Use always() to ensure cache is saved even if validation fails
       if: always() && steps.cache-aws-services.outputs.cache-hit != 'true'
-      uses: actions/cache/save@8b402f58fbc84540c8b491a91e594a4576fec3d7 # v5.0.2
+      uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
       with:
         path: ~/.cache/iam-validator/aws_services
         key: aws-services-${{ runner.os }}-${{ steps.week.outputs.week }}

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.15.6"
+__version__ = "1.16.0"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/iam_validator/checks/__init__.py

@@ -10,6 +10,7 @@ from iam_validator.checks.action_validation import ActionValidationCheck
 from iam_validator.checks.condition_key_validation import ConditionKeyValidationCheck
 from iam_validator.checks.condition_type_mismatch import ConditionTypeMismatchCheck
 from iam_validator.checks.full_wildcard import FullWildcardCheck
+from iam_validator.checks.ifexists_condition_check import IfExistsConditionCheck
 from iam_validator.checks.mfa_condition_check import MFAConditionCheck
 from iam_validator.checks.not_action_not_resource import NotActionNotResourceCheck
 from iam_validator.checks.policy_size import PolicySizeCheck
@@ -31,6 +32,7 @@ __all__ = [
     "ConditionKeyValidationCheck",
     "ConditionTypeMismatchCheck",
     "FullWildcardCheck",
+    "IfExistsConditionCheck",
     "MFAConditionCheck",
     "NotActionNotResourceCheck",
     "PolicySizeCheck",

iam_policy_validator-1.16.0/iam_validator/checks/condition_key_validation.py

@@ -0,0 +1,125 @@
+"""Condition key validation check - validates condition keys against AWS definitions."""
+
+from typing import ClassVar
+
+from iam_validator.core.aws_service import AWSServiceFetcher
+from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.condition_validators import has_if_exists_suffix
+from iam_validator.core.models import Statement, ValidationIssue
+
+
+class ConditionKeyValidationCheck(PolicyCheck):
+    """Validates condition keys against AWS service definitions and global keys."""
+
+    check_id: ClassVar[str] = "condition_key_validation"
+    description: ClassVar[str] = "Validates condition keys against AWS service definitions"
+    default_severity: ClassVar[str] = "error"  # Invalid condition keys are IAM policy errors
+
+    async def execute(
+        self,
+        statement: Statement,
+        statement_idx: int,
+        fetcher: AWSServiceFetcher,
+        config: CheckConfig,
+    ) -> list[ValidationIssue]:
+        """Execute condition key validation on a statement."""
+        issues = []
+
+        # Get conditions from statement
+        if not statement.condition:
+            return issues
+
+        # Check if global condition key warnings are enabled (default: True)
+        warn_on_global_keys = config.config.get("warn_on_global_condition_keys", True)
+
+        statement_sid = statement.sid
+        line_number = statement.line_number
+        actions = statement.get_actions()
+        resources = statement.get_resources()
+
+        # Extract all condition keys from all condition operators
+        for operator, conditions in statement.condition.items():
+            operator_has_ifexists = has_if_exists_suffix(operator)
+
+            for condition_key in conditions.keys():
+                key_valid_for_any_action = False
+                key_invalid_actions: list[tuple] = []
+                first_warning_result = None
+
+                # Validate this condition key against each action in the statement
+                for action in actions:
+                    # Skip wildcard actions
+                    if action == "*":
+                        continue
+
+                    # Validate against action and resource types
+                    result = await fetcher.validate_condition_key(action, condition_key, resources)
+
+                    if result.is_valid:
+                        key_valid_for_any_action = True
+                        if result.warning_message and first_warning_result is None:
+                            first_warning_result = (action, result)
+                    else:
+                        key_invalid_actions.append((action, result))
+
+                # If IfExists is used and the key is valid for at least one action,
+                # suppress errors for actions that don't support it.
+                # Warnings (global key usage) are still reported.
+                if operator_has_ifexists and key_valid_for_any_action:
+                    if first_warning_result and warn_on_global_keys:
+                        action, result = first_warning_result
+                        warning_msg = result.warning_message or ""
+                        issues.append(
+                            ValidationIssue(
+                                severity="warning",
+                                statement_sid=statement_sid,
+                                statement_index=statement_idx,
+                                issue_type="global_condition_key_with_action_specific",
+                                message=warning_msg,
+                                action=action,
+                                condition_key=condition_key,
+                                line_number=line_number,
+                                field_name="condition",
+                            )
+                        )
+                    continue  # Skip error reporting
+
+                # Report errors (first invalid action)
+                if key_invalid_actions:
+                    action, result = key_invalid_actions[0]
+                    issues.append(
+                        ValidationIssue(
+                            severity=self.get_severity(config),
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="invalid_condition_key",
+                            message=result.error_message
+                            or f"Invalid condition key: `{condition_key}`",
+                            action=action,
+                            condition_key=condition_key,
+                            line_number=line_number,
+                            suggestion=result.suggestion,
+                            field_name="condition",
+                        )
+                    )
+                    continue
+
+                # Report warnings for valid keys (no IfExists suppression path)
+                if first_warning_result and warn_on_global_keys:
+                    action, result = first_warning_result
+                    warning_msg = result.warning_message or ""
+                    issues.append(
+                        ValidationIssue(
+                            severity="warning",
+                            statement_sid=statement_sid,
+                            statement_index=statement_idx,
+                            issue_type="global_condition_key_with_action_specific",
+                            message=warning_msg,
+                            action=action,
+                            condition_key=condition_key,
+                            line_number=line_number,
+                            field_name="condition",
+                        )
+                    )
+
+        return issues

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/iam_validator/checks/condition_type_mismatch.py

@@ -8,6 +8,7 @@ from typing import ClassVar
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.condition_validators import (
+    has_if_exists_suffix,
     normalize_operator,
     translate_type,
     validate_value_for_type,
@@ -71,6 +72,25 @@ class ConditionTypeMismatchCheck(PolicyCheck):
                 # Unknown operator - this will be caught by another check
                 continue
 
+            # Detect NullIfExists as invalid syntax (must be BEFORE skip_operators guard)
+            if base_operator == "Null" and has_if_exists_suffix(operator):
+                issues.append(
+                    ValidationIssue(
+                        severity=self.get_severity(config),
+                        message=(
+                            f"Invalid operator `{operator}`. The `Null` condition operator "
+                            f"does not support the `IfExists` suffix. The `Null` operator "
+                            f"already checks for key existence \u2014 use `Null` directly."
+                        ),
+                        statement_sid=statement_sid,
+                        statement_index=statement_idx,
+                        issue_type="invalid_operator",
+                        line_number=line_number,
+                        field_name="condition",
+                    )
+                )
+                continue
+
             if base_operator in skip_operators:
                 continue
 

iam_policy_validator-1.16.0/iam_validator/checks/ifexists_condition_check.py

@@ -0,0 +1,210 @@
+"""IfExists Condition Usage Check.
+
+Validates proper usage of the IfExists suffix on IAM condition operators.
+
+Detects:
+- IfExists on security-sensitive keys in Allow statements (may bypass controls)
+- Non-negated IfExists in Deny statements (weakens the Deny)
+- IfExists on always-present keys (redundant)
+- Suggests IfExists for negated operators in Deny without it
+"""
+
+from typing import ClassVar
+
+from iam_validator.core.aws_service import AWSServiceFetcher
+from iam_validator.core.check_registry import CheckConfig, PolicyCheck
+from iam_validator.core.condition_validators import (
+    ALWAYS_PRESENT_CONDITION_KEYS,
+    SECURITY_SENSITIVE_CONDITION_KEYS,
+    has_if_exists_suffix,
+    is_negated_operator,
+    normalize_operator,
+)
+from iam_validator.core.models import Statement, ValidationIssue
+
+
+class IfExistsConditionCheck(PolicyCheck):
+    """Check for improper or risky usage of IfExists condition operators."""
+
+    check_id: ClassVar[str] = "ifexists_condition_usage"
+    description: ClassVar[str] = "Validates proper usage of IfExists suffix on condition operators"
+    default_severity: ClassVar[str] = "warning"
+
+    async def execute(
+        self,
+        statement: Statement,
+        statement_idx: int,
+        fetcher: AWSServiceFetcher,
+        config: CheckConfig,
+    ) -> list[ValidationIssue]:
+        """Execute IfExists condition usage checks."""
+        issues: list[ValidationIssue] = []
+
+        if not statement.condition:
+            return issues
+
+        statement_sid = statement.sid
+        line_number = statement.line_number
+        effect = statement.effect
+
+        # Config options
+        warn_security_sensitive_allow = config.config.get("warn_security_sensitive_allow", True)
+        suggest_deny_ifexists = config.config.get("suggest_deny_ifexists", False)
+        warn_always_present_keys = config.config.get("warn_always_present_keys", True)
+        additional_security_keys = config.config.get("additional_security_sensitive_keys", [])
+
+        # Build the full set of security-sensitive keys
+        security_keys = SECURITY_SENSITIVE_CONDITION_KEYS | frozenset(additional_security_keys)
+
+        # Collect Null-checked keys for suppression
+        null_checked_keys: set[str] = set()
+        for op, conds in statement.condition.items():
+            base_op, _, _ = normalize_operator(op)
+            if base_op == "Null":
+                for key, value in conds.items():
+                    # Only suppress if Null checks for key presence (value = "false")
+                    values = value if isinstance(value, list) else [value]
+                    if any(str(v).lower() == "false" for v in values):
+                        null_checked_keys.add(key)
+
+        for operator, conditions in statement.condition.items():
+            has_ifexists = has_if_exists_suffix(operator)
+            is_negated = is_negated_operator(operator)
+            base_op, _, _ = normalize_operator(operator)
+
+            for condition_key in conditions:
+                # Normalize condition key for case-insensitive comparison
+                key_lower = condition_key.lower()
+
+                # Skip MFA key - handled by mfa_condition_antipattern check
+                if key_lower == "aws:multifactorauthpresent":
+                    continue
+
+                if has_ifexists:
+                    # IfExists on always-present keys is redundant
+                    if warn_always_present_keys:
+                        always_present_match = any(
+                            k.lower() == key_lower for k in ALWAYS_PRESENT_CONDITION_KEYS
+                        )
+                        if always_present_match:
+                            # Reconstruct the operator without IfExists for the message
+                            raw_base = operator
+                            if ":" in operator:
+                                parts = operator.split(":", 1)
+                                if parts[0] in ("ForAllValues", "ForAnyValue"):
+                                    raw_base = parts[1]
+                            base_without_ifexists = (
+                                raw_base[:-8] if raw_base.endswith("IfExists") else raw_base
+                            )
+                            if ":" in operator:
+                                parts = operator.split(":", 1)
+                                if parts[0] in ("ForAllValues", "ForAnyValue"):
+                                    base_without_ifexists = f"{parts[0]}:{base_without_ifexists}"
+
+                            issues.append(
+                                ValidationIssue(
+                                    severity="info",
+                                    message=(
+                                        f"Redundant `IfExists`: The condition key "
+                                        f"`{condition_key}` is always present in the "
+                                        f"request context. Using `{operator}` has the "
+                                        f"same effect as `{base_without_ifexists}` for "
+                                        f"this key."
+                                    ),
+                                    statement_sid=statement_sid,
+                                    statement_index=statement_idx,
+                                    issue_type="ifexists_on_always_present_key",
+                                    condition_key=condition_key,
+                                    line_number=line_number,
+                                    field_name="condition",
+                                )
+                            )
+
+                    # Check if key is security-sensitive (case-insensitive)
+                    is_security_key = any(k.lower() == key_lower for k in security_keys)
+
+                    if effect == "Allow" and warn_security_sensitive_allow:
+                        # IfExists on security-sensitive keys in Allow may bypass controls
+                        if is_security_key:
+                            # Check for complementary Null check
+                            if condition_key not in null_checked_keys:
+                                issues.append(
+                                    ValidationIssue(
+                                        severity=self.get_severity(config),
+                                        message=(
+                                            f"Security control may be bypassed: "
+                                            f"`{operator}` with `{condition_key}` in "
+                                            f"an Allow statement means the restriction "
+                                            f"is not enforced when the key is missing "
+                                            f"from the request context. Not all API "
+                                            f"calls include `{condition_key}` (e.g., "
+                                            f"calls made by AWS services on your "
+                                            f"behalf). Consider using the operator "
+                                            f"without `IfExists` or adding a `Null` "
+                                            f"condition check."
+                                        ),
+                                        statement_sid=statement_sid,
+                                        statement_index=statement_idx,
+                                        issue_type="ifexists_weakens_security_condition",
+                                        condition_key=condition_key,
+                                        line_number=line_number,
+                                        field_name="condition",
+                                    )
+                                )
+
+                    elif effect == "Deny":
+                        # Non-negated IfExists in Deny weakens the restriction
+                        if not is_negated and is_security_key:
+                            if condition_key not in null_checked_keys:
+                                issues.append(
+                                    ValidationIssue(
+                                        severity=self.get_severity(config),
+                                        message=(
+                                            f"Weakened Deny: `{operator}` with "
+                                            f"`{condition_key}` in a Deny statement "
+                                            f"means the Deny does not apply when "
+                                            f"`{condition_key}` is missing from the "
+                                            f"request context. Consider removing "
+                                            f"`IfExists` or adding a `Null` condition "
+                                            f"check."
+                                        ),
+                                        statement_sid=statement_sid,
+                                        statement_index=statement_idx,
+                                        issue_type="ifexists_weakens_deny",
+                                        condition_key=condition_key,
+                                        line_number=line_number,
+                                        field_name="condition",
+                                    )
+                                )
+
+                elif not has_ifexists and effect == "Deny" and suggest_deny_ifexists:
+                    # Suggest IfExists for negated operator in Deny without it
+                    if is_negated:
+                        # Only suggest for keys that may be absent
+                        is_always_present = any(
+                            k.lower() == key_lower for k in ALWAYS_PRESENT_CONDITION_KEYS
+                        )
+                        is_security_key = any(k.lower() == key_lower for k in security_keys)
+                        if not is_always_present and is_security_key:
+                            issues.append(
+                                ValidationIssue(
+                                    severity="info",
+                                    message=(
+                                        f"Consider using `{base_op}IfExists` instead "
+                                        f"of `{base_op}` in this Deny statement. "
+                                        f"Without `IfExists`, the Deny does not apply "
+                                        f"when `{condition_key}` is missing from the "
+                                        f"request context. With `{base_op}IfExists`, "
+                                        f"the Deny still applies even when the key is "
+                                        f"absent."
+                                    ),
+                                    statement_sid=statement_sid,
+                                    statement_index=statement_idx,
+                                    issue_type="ifexists_deny_suggestion",
+                                    condition_key=condition_key,
+                                    line_number=line_number,
+                                    field_name="condition",
+                                )
+                            )
+
+        return issues

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/iam_validator/checks/set_operator_validation.py

@@ -11,6 +11,7 @@ from typing import ClassVar
 from iam_validator.core.aws_service import AWSServiceFetcher
 from iam_validator.core.check_registry import CheckConfig, PolicyCheck
 from iam_validator.core.condition_validators import (
+    has_if_exists_suffix,
     is_multivalued_context_key,
     normalize_operator,
 )
@@ -81,6 +82,7 @@ class SetOperatorValidationCheck(PolicyCheck):
         # Second pass: Validate set operator usage
         for operator, conditions in statement.condition.items():
             base_operator, _operator_type, set_prefix = normalize_operator(operator)
+            has_ifexists = has_if_exists_suffix(operator)
 
             if not set_prefix:
                 continue
@@ -110,15 +112,27 @@ class SetOperatorValidationCheck(PolicyCheck):
                 # Issue 2: ForAllValues with Allow effect without Null check (security risk)
                 if set_prefix == "ForAllValues" and effect == "Allow":
                     if condition_key not in null_checked_keys:
+                        if has_ifexists:
+                            message = (
+                                f"Compounded security risk: `{operator}` with `Allow` effect "
+                                f"on `{condition_key}` is doubly permissive. `ForAllValues` "
+                                f"passes when the value set is empty, and `IfExists` passes "
+                                f"when the key is missing entirely. Both mechanisms "
+                                f"independently allow access without matching any values. "
+                                f'Add: `"Null": {{"{condition_key}": "false"}}` and consider '
+                                f"removing `IfExists`."
+                            )
+                        else:
+                            message = (
+                                f"Security risk: `ForAllValues` with `Allow` effect on `{condition_key}` "
+                                f"should include a `Null` condition check. Without it, requests with missing "
+                                f'`{condition_key}` will be granted access. Add: `"Null": {{"{condition_key}": "false"}}`. '
+                                f"See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html"
+                            )
                         issues.append(
                             ValidationIssue(
                                 severity="warning",
-                                message=(
-                                    f"Security risk: `ForAllValues` with `Allow` effect on `{condition_key}` "
-                                    f"should include a `Null` condition check. Without it, requests with missing "
-                                    f'`{condition_key}` will be granted access. Add: `"Null": {{"{condition_key}": "false"}}`. '
-                                    f"See: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html"
-                                ),
+                                message=message,
                                 statement_sid=statement_sid,
                                 statement_index=statement_idx,
                                 issue_type="forallvalues_allow_without_null_check",

{iam_policy_validator-1.15.6 → iam_policy_validator-1.16.0}/iam_validator/core/check_registry.py

@@ -706,6 +706,7 @@ def create_default_registry(
         # 3. TYPE VALIDATION (Condition operator type checking)
         registry.register(checks.ConditionTypeMismatchCheck())  # Operator-value type compatibility
         registry.register(checks.SetOperatorValidationCheck())  # ForAllValues/ForAnyValue usage
+        registry.register(checks.IfExistsConditionCheck())  # IfExists usage validation
 
         # 4. RESOURCE MATCHING (Action-resource relationship validation)
         registry.register(