Status: IN
`aws:PrincipalIsAWSService` is `true` only when an AWS service principal (e.g., `cloudtrail.amazonaws.com`) makes a direct call — it is `false` when a service uses a service role or service-linked role.
Source: entries/2026/03/11/IAM-latest-UserGuide-reference_policies_condition-keyshtml.md