允许下载到特定 IP 地址的 S3 访问策略

Question

I'm trying to implement a batch virus scanner. I have a cron job set up to periodically scan unscanned files stored on S3. Whenever I try to wget the file, I get a 403 .

I've set up this policy:

{
    "Version": "2012-10-17",
    "Id": "S3PolicyIPRestrict",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "ip of my address/32"
                }
            }
        }
    ]
}

Any idea what I'm doing wrong?

Answer 1

Use the below bucket policy if you want to allow specfic ip address to access the files on s3 bucket.

 { "Version": "2012-10-17", "Id": "S3PolicyId1", "Statement": [ { "Sid": "IPAllow", "Effect": "Allow", "Principal": "*", "Action": "s3:*", "Resource": [ "arn:aws:s3:::<bucket>", "arn:aws:s3:::<bucket>/*" ], "Condition": { "IpAddress": { "aws:SourceIp": "<IP>/32" } } } ] }