I have s3 bucked in AWS bucket.test.com , I would like to have read and write access from my company public ip. My company has 3 public ip and i need to restrict s3 bucket to these ipaddress and it should not access able from outside company network. find the config which am using and its doesn't work.
{ "Version": "2008-10-17", "Id": "testPolicy", "Statement": [ { "Sid": "1", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:GetObject", "Resource": "arn:aws:s3:::bucket01.test.com/*”, "Condition": { "IpAddress": { "aws:SourceIp": "publicip1/32" }, "NotIpAddress": { "aws:SourceIp": "0.0.0.0" } } }, { "Sid": "2", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:*", "Resource": "arn:aws:s3:::bucket01.test.com/*", "Condition": { "IpAddress": { "aws:SourceIp": "publicip2/32" }, "NotIpAddress": { "aws:SourceIp": "0.0.0.0/0" } } }, { "Sid": "3", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": "s3:*", "Resource": "arn:aws:s3:::bucket01.test.com/*", "Condition": { "IpAddress": { "aws:SourceIp": “publicip3/32" }, "NotIpAddress": { "aws:SourceIp": "0.0.0.0/0" } } } ] }
"NotIpAddress": { "aws:SourceIp": "0.0.0.0" }
doesn't make sense to me. That's somewhat equivalent saying the IP address cannot be any IP address, including the one you're trying to allow... every IP address matches0.0.0.0/0
. – Michael - sqlbot May 3 '17 at 11:22