I would like to allow access to the S3 bucket by all users using a corporate IP address. I added a Bucket Policy but I'm still getting access denied. Is this possibly because my sourceIp is behind the corporate router?

    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::examplebucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": ""
  • 1
    What does What's My IP say your IP address is? – Tim Jul 2 at 23:19
  • @Tim - Thank you. After getting the outward facing IP address I'm able to download just fine. If you want to write something as an answer I'll go ahead and accept it! – Jeight Jul 2 at 23:25

You should determine your public IP address using a website such as What's My IP. Once you identify that and put it into your policy things should start to work with your existing policy.


If your corporate router is using NAT then S3 will only see the remapped IP of your external IP address on the router. If you only want access for your internal corporate network it may be better to create a VPN to a VPC and then an endpoint that is only accessible to the VPC: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-endpoints-s3.html

  • 2
    S3 buckets typically aren't part of a VPC. You'd have to restrict S3 access to a VPC somehow, and I haven't used S3 enough to know the best way. Probably some kind of bucket policy. – Tim Jul 2 at 23:19
  • 1
    true S3 typically isn't part of a VPC - but if you wanted to lock it down just to your corporate internal network this would be one way to do that. Otherwise you'll have to be cognizant of what your external IP addresse(s) are when they are NATted. Easy enough to find out if it's just one router and static : whatismyipaddress.com – Juraj Lisiak Jul 2 at 23:24
  • The downside of this is that your bandwidth to S3 is then limited by VPN throughput / latency. You also lose the benefit of redundant access to S3 endpoints, etc. So in it's an option indeed but I wouldn't do it this way. – MLu Jul 3 at 1:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.