0

I have s3 bucked in AWS bucket.test.com , I would like to have read and write access from my company public ip. My company has 3 public ip and i need to restrict s3 bucket to these ipaddress and it should not access able from outside company network. find the config which am using and its doesn't work.

{
    "Version": "2008-10-17",
    "Id": "testPolicy",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::bucket01.test.com/*”,
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "publicip1/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0"
        }
            }
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket01.test.com/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "publicip2/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0/0"
        }
            }
        },
        {
            "Sid": "3",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket01.test.com/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": “publicip3/32"
                },
                "NotIpAddress": {
                "aws:SourceIp": "0.0.0.0/0"
        }
            }
        }
    ]
}
  • "NotIpAddress": { "aws:SourceIp": "0.0.0.0" } doesn't make sense to me. That's somewhat equivalent saying the IP address cannot be any IP address, including the one you're trying to allow... every IP address matches 0.0.0.0/0. – Michael - sqlbot May 3 '17 at 11:22
0

This is directly addressed in the AWS documentation.

I've modified it slightly to show how to list multiple IP addresses. Note that if you list "allow" addresses it's denied by default to other IPs and you don't have to list either them or 0.0.0.0/0.

{
"Version": "2012-10-17",
"Id": "S3PolicyId1",
"Statement": [
  {
    "Sid": "IPAllow",
    "Effect": "Allow",
    "Principal": "*",
    "Action": "s3:*",
    "Resource": "arn:aws:s3:::examplebucket/*",
    "Condition": {
       "IpAddress": {"aws:SourceIp": ["54.240.143.0/24", "1.2.3.4/32", "4.3.2.1/32"]}
     } 
  }]
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.