Restrict S3 backup to Organisation public IPaddress

Question

I have s3 bucked in AWS bucket.test.com , I would like to have read and write access from my company public ip. My company has 3 public ip and i need to restrict s3 bucket to these ipaddress and it should not access able from outside company network. find the config which am using and its doesn't work.

{
    "Version": "2008-10-17",
    "Id": "testPolicy",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket01.test.com/*”,
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "publicip1/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0"
        }
            }
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket01.test.com/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "publicip2/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0/0"
        }
            }
        },
        {
            "Sid": "3",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket01.test.com/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": “publicip3/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0/0"
        }
            }
        }
    ]
}

Answer 1

This is directly addressed in the AWS documentation.

I've modified it slightly to show how to list multiple IP addresses. Note that if you list "allow" addresses it's denied by default to other IPs and you don't have to list either them or 0.0.0.0/0.

{
"Version": "2012-10-17",
"Id": "S3PolicyId1",
"Statement": [
  {
    "Sid": "IPAllow",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::examplebucket/*",
    "Condition": {
       "IpAddress": {"aws:SourceIp": ["54.240.143.0/24", "1.2.3.4/32", "4.3.2.1/32"]}
     } 
  }]
}