Enhance IAM Policies with Nested Logic and Dynamic AND/OR Grouping for Conditions

The current system allows for the creation of multiple conditions within a single policy. However, these conditions are evaluated as a simple, flat list. The logical operator connecting these conditions (either AND or OR) applies to the entire set, and there is no capability to group or nest conditions to create more complex logical expressions.

We request the ability to dynamically group and combine conditions using both AND and OR operators. This would allow for the creation of sophisticated, granular access rules that more accurately reflect real-world security requirements.

Current Limitation:

If I create multiple conditions, such as one for an API Key, one for an IP range, and one for a hostname, they are treated as separate, ungrouped checks. I can set them to be joined by either AND or OR, but I cannot combine the operators. For example, I can have:

Condition A AND Condition B AND Condition C OR

Condition A OR Condition B OR Condition C

It is not possible to create a nested logical expression.

Requested Enhancement (Use Case Example):

We need the ability to enforce a policy that requires a specific condition to be met, along with one of several other possible conditions. For instance, access should only be granted if a specific API key is used AND the request originates from either a trusted IP range OR a specific hostname.

The desired logical structure would be: API-Key AND (IP-Range OR hostname address)

This enhancement would introduce a much-needed level of flexibility and precision to IAM policies, enabling administrators to define access controls that are both more powerful and more secure.