CODEWITHSUNDEEP
amazon-web-servicessecurityamazon-s3policy
Daniel Cukier
Daniel Cukier

Reputation: 11942

Amazon S3 files access policy based on IP Address

Is there any way to limit the access of a file stored in Amazon S3 based on the client IP address?

I have a file stored there, which should be access only by specific IP address. How to do this?

Upvotes: 35

Views: 45123

Answers (2)

gview
gview

Reputation: 15361

Yes there is, although I have not used this myself.

S3 supports granular control over buckets and objects in them using "Access Policy Language". There is specific whitelist and blacklist IP statements available. You will have to write the APL statements and upload them, however.

http://docs.amazonwebservices.com/AmazonS3/latest/dev/AccessPolicyLanguage.html

Here are 2 condition section examples:

Whitelist

"Condition" :  {
       "IpAddress" : {
          "aws:SourceIp" : ["192.168.176.0/24","192.168.143.0/24"]
      }
}

Blacklist

"Condition" :  {
       "NotIpAddress" : {
          "aws:SourceIp" : ["192.168.176.0/24","192.168.143.0/24"]
      }
}

Upvotes: 43

O'Shaughnessy Evans
O'Shaughnessy Evans

Reputation: 369

Amazon describes this in their S3 docs under "Bucket Policy Examples", at Restricting Access to Specific IP Addresses:

The condition in this statement identifies the 54.240.143.* range of allowed IP addresses, with one exception: 54.240.143.188.

{
  "Version": "2012-10-17",
  "Id": "S3PolicyId1",
  "Statement": [
    {
      "Sid": "IPAllow",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::examplebucket/*",
      "Condition": {
         "IpAddress": {"aws:SourceIp": ["54.240.143.0/24", "1.2.3.4/32" ]},
         "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"} 
      } 
    } 
  ]
}

You could add something like that in the AWS S3 console. Select your bucket, click the Properties tab, then Permissions. Click "Add bucket policy" and paste it into the popup dialogue's form.

I modified Amazon's example to show how multiple IP ranges can be included in the policy by providing a JSON array instead of a string. The "aws:SourceIp" entry of "1.2.3.4/32" means that the single IP address, 1.2.3.4, is also granted access.

Upvotes: 26

Related Questions