Amazon S3策略-IP地址或HTTP引用

Question

I was wondering if it's possible to combine two statements in a bucket policy to achieve the following scenario:

• A specific IP address, abcd , is allowed to perform any action;
• A CDN host, http://cdn.example.com , is allowed to perform just GetObject action to serve content.

I don't know exactly which IP addresses cdn.example.com will use, so I can't just rely on IP address policy.

Let's suppose the bucket is named public , I tried the following policy

{
  "Version": "2012-10-17",
  "Id": "S3PolicyId1",
  "Statement": [
    {
      "Sid": "Allow CDN referrer",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::public/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": "http://cdn.example.com/*"
        }
      }
    },
    {
      "Sid": "Deny everyone except for a.b.c.d",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": "arn:aws:s3:::public/*",
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": "a.b.c.d"
        }
      }
    }
  ]
}

The two statements behave as expected singularly, but when combined the result is that only abcd is able to access the bucket publicly, probably because cdn.example.com IP address is blocked by the second statement.

At this point, I wonder if what I want to achieve is possible, maybe using different statements, or not possible at all.

edit

abcd IP address does not belong to cdn.example.com, it's another organization's IP address.

In the policy I want to enable a host evaluating HTTP referer OR IP address.

After rephrasing the statements I have the following

{
  "Version": "2012-10-17",
  "Id": "S3PolicyId1",
  "Statement": [
    {
      "Sid": "Allow CDN referrer",
      "Effect": "Allow",
      "Principal": "*",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::public/*",
      "Condition": {
        "StringLike": {
          "aws:Referer": "http://cdn.example.com/*"
        },
        "IpAddress": {
          "aws:SourceIp": "a.b.c.d"
        }
      }
    }
  ]
}

However, the problem is that the two contitions StringLike and IpAddress are evaluated in AND , while I need OR .

---

Edit:

However, the problem is that the two contitions StringLike and IpAddress are evaluated in AND , while I need OR .

According to documentation, more Conditions are evaluated with logical AND, while more options inside a single condition are evaluated in OR, and I found no way to achieve what I want.

Answer 1

The key to remember is that the order of priority for effects is Deny first, Allow second (and default Deny last). Any Deny effects will override Allow effects, and if you don't explicitly Allow access, it's denied by default.

What you probably want to do is rephrase your second condition into an Allow policy - rather than "Deny" everyone that's not from that IP, specifically "Allow" that IP.

It might also be possible to define what you want with compound conditions (see the documentation for more info), though in this specific case, I think redefining your second policy into Allow will work best.

Answer 2

you can use 2 seperate allow condition to work as an OR condition

 {
      "Version": "2012-10-17",
      "Id": "S3PolicyId1",
      "Statement": [
        {
          "Sid": "Allow CDN referrer Http",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::public/*",
          "Condition": {
            "StringLike": {
              "aws:Referer": "http://cdn.example.com/*"
            }
          }
        },
        {
          "Sid": "Allow CDN referrer IP",
          "Effect": "Allow",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::public/*",
          "Condition": {
            "IpAddress": {
              "aws:SourceIp": "a.b.c.d"
            }
          }
        }
      ]
    }