AWS SNS策略IP地址访问

Question

In SNS, I set up a topic.

In IAM, I have set up a policy to allow access to the topics ARN from only from a specific IP address:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "sns:Publish",
                "sns:Subscribe"
            ],
            "Resource": "arn:aws:sns:us-east-1:111111111111:topic_name",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "xxx.xxx.xxx.x"
                }
            }
        }
    ]
}

I have attached this policy to a group, and added a user to this group.

From a C# windows application, I can now subscribe and publish the topic from the specified SourceIp listed in the policy.

But in this case, I need to use the AccessKey and SecretAccessKey of the IAM user.

Is there a way that I can bypass needing the AccessKey and SecretKey as long as the SourceIp is correct?

I see that the SNS topic "topic policy", but I could not figure out how to add the IpAddress Condition. Is that possible?

topic policy:

{
  "Version": "2008-10-17",
  "Id": "__default_policy_ID",
  "Statement": [
    {
      "Sid": "__default_statement_ID",
      "Effect": "Allow",
      "Principal": {
        "AWS": "*"
      },
      "Action": [
        "SNS:GetTopicAttributes",
        "SNS:SetTopicAttributes",
        "SNS:AddPermission",
        "SNS:RemovePermission",
        "SNS:DeleteTopic",
        "SNS:Subscribe",
        "SNS:ListSubscriptionsByTopic",
        "SNS:Publish",
        "SNS:Receive"
      ],
      "Resource": "arn:aws:sns:us-east-1:111111111111:topic_name",
      "Condition": {
        "StringEquals": {
          "AWS:SourceOwner": "111111111111"
        }
      }
    }
  ]
}

Answer 1

Amazon SNS requires authentication and authorization to use the service. This means either an IAM user or role. This means you must use credentials to access the service.

I would combine IAM User Policies with SNS Policies to control who (user or service) can publish / subscribe to SNS.

There are many AWS services that can use SNS. Your IP address policy may break them.

SNS: Controlling User Access to Your AWS Account