How to allow Amazon S3 access from specific IPs

Question

I am trying this policy to allow users to Put and List object access with a particular IP (56.160.12.114) only and all the rest should have only Get access. But this policy is not working for me:

{
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPDeny",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-wicked-awesome-bucket/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "56.160.12.114/28"
                }
            }
        }
    ]
}

Answer 1

This policy is saying: Deny access to anyone who is not using this range of IP addresses

That's fine, but you will also need a policy that Allows access, because the default behaviour is Deny. Thus, you are Denying people who are already denied by default.

A better way would be:

• Have default Deny access (happens automatically)
• Allow access based on IP

Something like this:

{
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-wicked-awesome-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "56.160.12.114/28"
                }
            }
        }
    ]
}

Please note, however, that this is granting s3:* access to any system that is coming from that range of IP addresses (including whatever is connected to that network range). Make sure you're okay with that.

Update:

If you only want to grant the user the ability to Put and List the object, then use:

{
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": [
                "s3:PutObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::jstack-b",
                "arn:aws:s3:::jstack-b/*"
            ],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "56.160.12.114/28"
                }
            }
        }
    ]
}