Answers: <p>please attach below policy to your AWS S3 Bucket.</p>
  
  <blockquote>
    <p><strong>Allow Access to Specific IP Addresses</strong></p>
  </blockquote>
  
  <pre><code> &lt;div class="code"&gt;  
   {  
     "Id": "S3PolicyId1",  
     "Statement": [  
       {  
         "Sid": "IPDeny",  
         "Effect": "Deny",  
         "Principal": {  
           "AWS": "*"  
         },  
         "Action": "s3:*",  
         "Resource": "arn:aws:s3:::bucket/*",  
         "Condition": {  
           "IpAddress": {  
             "aws:SourceIp": "54.240.143.188/32"  
           }  
         }  
       }  
     ]  
   }  
   &lt;/div&gt;
  </code></pre>
  
  <blockquote>
    <p><strong>Deny Access to Specific IP Addresses</strong></p>
  </blockquote>
  
  <pre><code>{  
    "Version": "2012-10-17",  
    "Id": "S3PolicyId1",  
    "Statement": [  
     {  
      "Sid": "IPAllow",  
      "Effect": "Allow",  
      "Principal": "*",  
      "Action": "s3:*",  
      "Resource": "arn:aws:s3:::bucket/*",  
      "Condition": {  
        "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}   
      }   
     }   
    ]  
   }
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2019-01-26T02:18:33.120Z
Answers: **This answer is not safe.** The second policy shown here is very dangerous.  It allows unrestricted access to any action against the bucket, even by anonymous users, from any IP address except the one shown.   The first policy denies all access to the bucket except from the listed address.  This policy will lock you out of the bucket from the console.  So, in addition to being dangerous, the descriptions of what the policies will do is incorrect.
Answers: Michael - sqlbot
Answers: CC BY-SA 4.0
Answers: 2019-01-26T02:23:19.010Z
Answers: Additionally, I'd suggest that it's best to avoid real IP addresses as example addresses.  [RFC-5737](https://tools.ietf.org/html/rfc5737) reserves 192.0.2.0 through .255, 198.51.100.0 through .255, and 203.0.113.0 through .255, for exactly this purpose.  These addresses are not routable on the Internet and are thus unlikely to cause any problems when used for examples.
Answers: Michael - sqlbot
Answers: CC BY-SA 4.0
Answers: 2019-01-25T05:12:32.620Z
Answers: 2019-01-25T05:17:53.623Z
Answers: 2019-01-25T05:17:53.623Z
Answers: Subhash
Body: <p>Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.</p>
  
  <p>Is there anyway to Allow AWS S3 Access From only Specific IPs?</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-01-24T14:10:28.927Z
Comments: Yes, that's called a bucket policy and it's pretty well documented in AWS S3 documentation. Where are you struck on this ?
Comments: Tensibai
Tags: <amazon-web-services><amazon-s3><aws-vpc>
Title: How to Allow AWS S3 Access From only Specific IPs
UserDisplayName: Jay
ThreadText: # How to Allow AWS S3 Access From only Specific IPs
  
  (Asked by: username_0 on 2019-01-24)
  
  Recently we were testing with AWS VPC, and a requirement for our project was that we needed to allow nodes within a VPC access to S3 buckets, but deny access from any other IP address.
  
  Is there anyway to Allow AWS S3 Access From only Specific IPs?
  
  **Tags:** amazon-web-services, amazon-s3, aws-vpc
  
  > **Comments:**
  > **username_1**: Yes, that's called a bucket policy and it's pretty well documented in AWS S3 documentation. Where are you struck on this ?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-01-25. Score: 1 | Accepted answer
  
  please attach below policy to your AWS S3 Bucket.
  
  > **Allow Access to Specific IP Addresses**
  
  ```
   <div class="code">  
   {  
     "Id": "S3PolicyId1",  
     "Statement": [  
       {  
         "Sid": "IPDeny",  
         "Effect": "Deny",  
         "Principal": {  
           "AWS": "*"  
         },  
         "Action": "s3:*",  
         "Resource": "arn:aws:s3:::bucket/*",  
         "Condition": {  
           "IpAddress": {  
             "aws:SourceIp": "54.240.143.188/32"  
           }  
         }  
       }  
     ]  
   }  
   </div>
  
  ```
  
  > **Deny Access to Specific IP Addresses**
  
  ```
  {  
    "Version": "2012-10-17",  
    "Id": "S3PolicyId1",  
    "Statement": [  
     {  
      "Sid": "IPAllow",  
      "Effect": "Allow",  
      "Principal": "*",  
      "Action": "s3:*",  
      "Resource": "arn:aws:s3:::bucket/*",  
      "Condition": {  
        "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"}   
      }   
     }   
    ]  
   }
  
  ```
  
  > **Comments:**
  > **username_3**: **This answer is not safe.** The second policy shown here is very dangerous.  It allows unrestricted access to any action against the bucket, even by anonymous users, from any IP address except the one shown.   The first policy denies all access to the bucket except from the listed address.  This policy will lock you out of the bucket from the console.  So, in addition to being dangerous, the descriptions of what the policies will do is incorrect.  
  > **username_3**: Additionally, I'd suggest that it's best to avoid real IP addresses as example addresses.  [RFC-5737](https://tools.ietf.org/html/rfc5737) reserves 192.0.2.0 through .255, 198.51.100.0 through .255, and 203.0.113.0 through .255, for exactly this purpose.  These addresses are not routable on the Internet and are thus unlikely to cause any problems when used for examples.  
  
  ---
  
  