How to Allow AWS S3 Access From only Specific IPs

Question

Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.

Is there anyway to Allow AWS S3 Access From only Specific IPs?

Answer 1

please attach below policy to your AWS S3 Bucket.

Allow Access to Specific IP Addresses

 <div class="code">  
 {  
   "Id": "S3PolicyId1",  
   "Statement": [  
     {  
       "Sid": "IPDeny",  
       "Effect": "Deny",  
       "Principal": {  
         "AWS": "*"  
       },  
       "Action": "s3:*",  
       "Resource": "arn:aws:s3:::bucket/*",  
       "Condition": {  
         "IpAddress": {  
           "aws:SourceIp": "54.240.143.188/32"  
         }  
       }  
     }  
   ]  
 }  
 </div>

Deny Access to Specific IP Addresses

{  
  "Version": "2012-10-17",  
  "Id": "S3PolicyId1",  
  "Statement": [  
   {  
    "Sid": "IPAllow",  
    "Effect": "Allow",  
    "Principal": "*",  
    "Action": "s3:*",  
    "Resource": "arn:aws:s3:::bucket/*",  
    "Condition": {  
      "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}   
    }   
   }   
  ]  
 }