Authorization Policy Conditions

 2 minute read

This page describes the supported keys and value formats you can use as conditions in the when field of an authorization policy rule.

For more information, refer to the authorization concept page.

Supported Conditions

NameDescriptionSupported ProtocolsExample
request.headersHTTP request headers. The actual header name is surrounded by bracketsHTTP onlykey: request.headers[User-Agent]
values: ["Mozilla/*"]
source.ipSource workload instance IP address, supports single IP or CIDRHTTP and TCPkey: source.ip
values: ["10.1.2.3"]
source.namespaceSource workload instance namespace, requires mutual TLS enabledHTTP and TCPkey: source.namespace
values: ["default"]
source.principalThe identity of the source workload, requires mutual TLS enabledHTTP and TCPkey: source.principal
values: ["cluster.local/ns/default/sa/productpage"]
request.auth.principalThe authenticated principal of the request.HTTP onlykey: request.auth.principal
values: ["accounts.my-svc.com/104958560606"]
request.auth.audiencesThe intended audience(s) for this authentication informationHTTP onlykey: request.auth.audiences
values: ["my-svc.com"]
request.auth.presenterThe authorized presenter of the credentialHTTP onlykey: request.auth.presenter
values: ["123456789012.my-svc.com"]
request.auth.claimsClaims from the origin JWT. The actual claim name is surrounded by bracketsHTTP onlykey: request.auth.claims[iss]
values: ["*@foo.com"]
destination.ipDestination workload instance IP address, supports single IP or CIDRHTTP and TCPkey: destination.ip
values: ["10.1.2.3", "10.2.0.0/16"]
destination.portThe recipient port on the server IP address, must be in the range [0, 65535]HTTP and TCPkey: destination.port
values: ["80", "443"]
connection.sniThe server name indication, requires mutual TLS enabledHTTP and TCPkey: connection.sni
values: ["www.example.com"]
experimental.envoy.filters.*Experimental metadata matching for filters, values wrapped in [] are matched as a listHTTP and TCPkey: experimental.envoy.filters.network.mysql_proxy[db.table]
values: ["[update]"]
Was this information useful?
Do you have any suggestions for improvement?

Thanks for your feedback!