<p>please attach below policy to your AWS S3 Bucket.</p>

<blockquote>
  <p><strong>Allow Access to Specific IP Addresses</strong></p>
</blockquote>

<pre><code> &lt;div class="code"&gt;  
 {  
   "Id": "S3PolicyId1",  
   "Statement": [  
     {  
       "Sid": "IPDeny",  
       "Effect": "Deny",  
       "Principal": {  
         "AWS": "*"  
       },  
       "Action": "s3:*",  
       "Resource": "arn:aws:s3:::bucket/*",  
       "Condition": {  
         "IpAddress": {  
           "aws:SourceIp": "54.240.143.188/32"  
         }  
       }  
     }  
   ]  
 }  
 &lt;/div&gt;
</code></pre>

<blockquote>
  <p><strong>Deny Access to Specific IP Addresses</strong></p>
</blockquote>

<pre><code>{  
  "Version": "2012-10-17",  
  "Id": "S3PolicyId1",  
  "Statement": [  
   {  
    "Sid": "IPAllow",  
    "Effect": "Allow",  
    "Principal": "*",  
    "Action": "s3:*",  
    "Resource": "arn:aws:s3:::bucket/*",  
    "Condition": {  
      "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}   
    }   
   }   
  ]  
 }
</code></pre>

CC BY-SA 4.0
2019-01-26T02:18:33.120Z
**This answer is not safe.** The second policy shown here is very dangerous.  It allows unrestricted access to any action against the bucket, even by anonymous users, from any IP address except the one shown.   The first policy denies all access to the bucket except from the listed address.  This policy will lock you out of the bucket from the console.  So, in addition to being dangerous, the descriptions of what the policies will do is incorrect.
Michael - sqlbot
CC BY-SA 4.0
2019-01-26T02:23:19.010Z
Additionally, I'd suggest that it's best to avoid real IP addresses as example addresses.  [RFC-5737](https://tools.ietf.org/html/rfc5737) reserves 192.0.2.0 through .255, 198.51.100.0 through .255, and 203.0.113.0 through .255, for exactly this purpose.  These addresses are not routable on the Internet and are thus unlikely to cause any problems when used for examples.
Michael - sqlbot
CC BY-SA 4.0
2019-01-25T05:12:32.620Z
2019-01-25T05:17:53.623Z
2019-01-25T05:17:53.623Z
Subhash
<p>Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.</p>

<p>Is there anyway to Allow AWS S3 Access From only Specific IPs?</p>

CC BY-SA 4.0
2019-01-24T14:10:28.927Z
Yes, that's called a bucket policy and it's pretty well documented in AWS S3 documentation. Where are you struck on this ?
Tensibai
<amazon-web-services><amazon-s3><aws-vpc>
How to Allow AWS S3 Access From only Specific IPs
Jay
# How to Allow AWS S3 Access From only Specific IPs

(Asked by: username_0 on 2019-01-24)

Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.

Is there anyway to Allow AWS S3 Access From only Specific IPs?

**Tags:** amazon-web-services, amazon-s3, aws-vpc

> **Comments:**
> **username_1**: Yes, that's called a bucket policy and it's pretty well documented in AWS S3 documentation. Where are you struck on this ?  

---

## 1 answers

### Answer by username_2 on 2019-01-25. Score: 1 | Accepted answer

please attach below policy to your AWS S3 Bucket.

Allow Access to Specific IP Addresses

   
 {  
   "Id": "S3PolicyId1",  
   "Statement": [  
     {  
       "Sid": "IPDeny",  
       "Effect": "Deny",  
       "Principal": {  
         "AWS": "*"  
       },  
       "Action": "s3:*",  
       "Resource": "arn:aws:s3:::bucket/*",  
       "Condition": {  
         "IpAddress": {  
           "aws:SourceIp": "54.240.143.188/32"  
         }  
       }  
     }  
   ]  
 }  
 


Deny Access to Specific IP Addresses

{  
  "Version": "2012-10-17",  
  "Id": "S3PolicyId1",  
  "Statement": [  
   {  
    "Sid": "IPAllow",  
    "Effect": "Allow",  
    "Principal": "*",  
    "Action": "s3:*",  
    "Resource": "arn:aws:s3:::bucket/*",  
    "Condition": {  
      "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}   
    }   
   }   
  ]  
 }

> **Comments:**
> **username_3**: **This answer is not safe.** The second policy shown here is very dangerous.  It allows unrestricted access to any action against the bucket, even by anonymous users, from any IP address except the one shown.   The first policy denies all access to the bucket except from the listed address.  This policy will lock you out of the bucket from the console.  So, in addition to being dangerous, the descriptions of what the policies will do is incorrect.  
> **username_3**: Additionally, I'd suggest that it's best to avoid real IP addresses as example addresses.  [RFC-5737](https://tools.ietf.org/html/rfc5737) reserves 192.0.2.0 through .255, 198.51.100.0 through .255, and 203.0.113.0 through .255, for exactly this purpose.  These addresses are not routable on the Internet and are thus unlikely to cause any problems when used for examples.  

---

