Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.
Is there anyway to Allow AWS S3 Access From only Specific IPs?
-
1Yes, that's called a bucket policy and it's pretty well documented in AWS S3 documentation. Where are you struck on this ? – Tensibai Jan 24 '19 at 14:10
Add a comment
|
please attach below policy to your AWS S3 Bucket.
Allow Access to Specific IP Addresses
<div class="code">
{
"Id": "S3PolicyId1",
"Statement": [
{
"Sid": "IPDeny",
"Effect": "Deny",
"Principal": {
"AWS": "*"
},
"Action": "s3:*",
"Resource": "arn:aws:s3:::bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "54.240.143.188/32"
}
}
}
]
}
</div>
Deny Access to Specific IP Addresses
{
"Version": "2012-10-17",
"Id": "S3PolicyId1",
"Statement": [
{
"Sid": "IPAllow",
"Effect": "Allow",
"Principal": "*",
"Action": "s3:*",
"Resource": "arn:aws:s3:::bucket/*",
"Condition": {
"NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}
}
}
]
}
-
This answer is not safe. The second policy shown here is very dangerous. It allows unrestricted access to any action against the bucket, even by anonymous users, from any IP address except the one shown. The first policy denies all access to the bucket except from the listed address. This policy will lock you out of the bucket from the console. So, in addition to being dangerous, the descriptions of what the policies will do is incorrect. – Michael - sqlbot Jan 26 '19 at 2:18
-
Additionally, I'd suggest that it's best to avoid real IP addresses as example addresses. RFC-5737 reserves 192.0.2.0 through .255, 198.51.100.0 through .255, and 203.0.113.0 through .255, for exactly this purpose. These addresses are not routable on the Internet and are thus unlikely to cause any problems when used for examples. – Michael - sqlbot Jan 26 '19 at 2:23
