AWS访问受公共IP或VPC限制

Question

I'm trying to use an IAM policy to restrict access for all AWS resources to either a public IP or a VPC. Documentation suggests this should work and it seems to work fine for the IP case. But as soon as I add the condition for the VPC, it breaks.

{
    "Version": "2012-10-17",
    "Statement": {
        "Effect": "Deny",
        "Action": "*",
        "Resource": "*",
        "Condition": {
            "NotIpAddressIfExists": {
                "aws:SourceIp": "a.b.c.d/32"
            },
            "StringNotEqualsIfExists": {
                "aws:sourceVpc": "vpc-1234wxyz"
            }
        }
    }
}

Answer 1

In a "Deny" Statement, if any of the Conditions are satisfied the request will be denied.

For requests coming from outside of your VPC, "aws:SourceIp" exists and "aws:sourceVpc" does not exist, so it only evaluates your "aws:SourceIp" condition.

For requests coming from inside of your VPC, "aws:SourceIp" exists and "aws:sourceVpc" exists, so it evaluates both. Since you are inside your VPC that condition allows access, but since your source IP is the IP of your AWS instance that condition denies access.

Basically, the problem is you are relying on "IfExists" with the assumption that only one or the other will exist, but inside your VPC both exist. There is a special case for this, only if the request comes via an Endpoint (such as to S3):

Note

If the request comes from a host that uses an Amazon VPC endpoint, then the aws:SourceIp key is not available. You should instead use a VPC-specific key. For more information, see VPC Endpoints - Controlling the Use of Endpoints in the Amazon VPC User Guide.

Only in that special case, Amazon removes "aws:SourceIp" which would make your "IsExists" work.