Allow or deny access based on time of day

Scenario

In this example, you want to grant a RAM principal permissions to manage all ECS resources, but only for a limited time. Specifically, access should be denied after a specific deadline.

Policy pxample

The following policy grants permissions for all ECS actions, but only if the request is made before 17:00 (UTC+8) on August 12, 2019.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "ecs:*",
            "Resource": "*",
            "Condition": {
                "DateLessThan": {
                    "acs:CurrentTime": "2019-08-12T17:00:00+08:00"
                }
            }
        }
    ]
}

How this policy works

• The Effect element is set to Allow, which means this statement grants permissions if the condition is met.

• The Action and Resource elements grant broad permissions to all ECS actions (ecs:*) on all resources (*).

• The Condition block is the key component. It uses the DateLessThan conditional operator to evaluate the acs:CurrentTime key.

• The acs:CurrentTime key represents the time when RAM receives the API request.

• The policy is evaluated as true only if the current time is before (less than) the specified timestamp. If the request is made at or after this time, the condition is false, and the Allow statement has no effect. Because RAM denies requests by default, the user is denied access.