Repository: aws-cloudformation/cfn-lint

Issue:
AWS::IAM::ManagedPolicy Condition syntax error not detected
### CloudFormation Lint Version

cfn-lint 1.16.1

### What operating system are you using?

Linux

### Describe the bug

cfn-lint is not detecting missing Condition operator.

```shell
$ cfn-lint --format json --include-checks I -t ./demo-template.yaml
[]

$ 
```


CloudFormation throws the following syntax error:

```
Resource handler returned message: "Syntax errors in policy. (Service: Iam, Status Code: 400, Request ID: <redacted>)" (RequestToken: <redacted>, HandlerErrorCode: InvalidRequest)
```

### Expected behavior

The missing operator should be detected.

### Reproduction template

```yaml
---
AWSTemplateFormatVersion: '2010-09-09'
Description: Example IAM policy syntax error not detected.

Resources:
  IAMPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Roles:
        - DemoRole
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action:
              - servicecatalog:*
            Resource: '*'
            Condition:
                servicecatalog:accountLevel: self
```


Discussion:

Patch:
diff --git a/src/cfnlint/data/schemas/other/iam/policy.json b/src/cfnlint/data/schemas/other/iam/policy.json
index 0bbe33bed9..99f30247c8 100644
--- a/src/cfnlint/data/schemas/other/iam/policy.json
+++ b/src/cfnlint/data/schemas/other/iam/policy.json
@@ -68,6 +68,7 @@
    ]
   },
   "Condition": {
+   "additionalProperties": false,
    "patternProperties": {
     "ForAllValues:^(Not)?IpAddress$": {
      "$ref": "#/definitions/ConditionSetValue"


Test patch:
diff --git a/test/unit/rules/resources/iam/test_identity_policy.py b/test/unit/rules/resources/iam/test_identity_policy.py
index 3ba94c683f..ec145becd6 100644
--- a/test/unit/rules/resources/iam/test_identity_policy.py
+++ b/test/unit/rules/resources/iam/test_identity_policy.py
@@ -162,3 +162,35 @@ def test_string_statements(self):
             errs[1].message, "'2012-10-18' is not one of ['2008-10-17', '2012-10-17']"
         )
         self.assertListEqual(list(errs[1].path), ["Version"])
+
+    def test_string_statements_with_condition(self):
+        validator = CfnTemplateValidator()
+
+        policy = """
+            {
+                "Version": "2012-10-17",
+                "Statement": [
+                    {
+                        "Effect": "Allow",
+                        "Action": "*",
+                        "Resource": "*",
+                        "Condition": {
+                            "iam:PassedToService": "cloudformation.amazonaws.com"
+                        }
+                    }
+                ]
+            }
+        """
+
+        errs = list(
+            self.rule.validate(
+                validator=validator, policy=policy, schema={}, policy_type=None
+            )
+        )
+        self.assertEqual(len(errs), 1, errs)
+        self.assertTrue(
+            errs[0].message.startswith("'iam:PassedToService' does not match")
+        )
+        self.assertListEqual(
+            list(errs[0].path), ["Statement", 0, "Condition", "iam:PassedToService"]
+        )