如何为 S3 访问日志目标存储桶创建具有 sourceIP 限制的存储桶策略？

Question

I have created one S3 bucket and have enabled server access logging. There is another S3 bucket which is the target bucket for server access log delivery of the first bucket I mentioned.

Now there is a requirement to keep sourceIP restriction on the target bucket's policy, so the policy on the target bucket is somewhat as below -

{
    "Version": "2012-10-17",
    "Id": "Policy1234567890",
    "Statement": [
        {
            "Sid": "Allow-only-specific-sourceIPs",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::log-target-bucket-xyz",
                "arn:aws:s3:::log-target-bucket-xyz/*"
            ],
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "10.0.0.1",
                        "10.0.0.2"
                    ]
                },
                "StringNotEquals": {
                    "aws:sourceVpce": "vpce-1234xyz",
                    "aws:username": "xyz-user"
                }
            }
        }
    ]
}

But with this policy the server access logs aren't getting delivered to the bucket. This policy is supposed to allow S3 actions to only the source IPs, vpc endpoints and username in condition.

The target bucket has following ACL also:

{
       "Grantee": {
            "Type": "Group",
            "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
        },
        "Permission": "WRITE"
    },
    {
        "Grantee": {
            "Type": "Group",
            "URI": "http://acs.amazonaws.com/groups/s3/LogDelivery"
        },
        "Permission": "READ_ACP"
    }

The Problem is: The S3 server access logs are not getting generated and I need to keep the sourceIP, vpce restriction on the target bucket. The problem resolves If I remove the restrictions from bucket policy. But can't seem to find a solution to have logs generated with the restrictions.

Edit: Tried the following condition, but didn't work:

"StringNotLikeIfExists": {
  "s3:x-amz-grant-write": "acs.amazonaws.com/groups/s3/LogDelivery"
}

Please let me know if anyone has any solution or suggestions to solve this problem. Any help is very much appreciated.

Thanks!

Answer 1

Your policy should be a combination if NotIpAddressIfExists and StringNotEqualsIfExists conditions as described in:

    {
        "Version": "2012-10-17",
        "Id": "Policy1234567890",
        "Statement": [
            {
                "Sid": "Allow-only-specific-sourceIPs",
                "Effect": "Deny",
                "Principal": "*",
                "Action": "s3:*",
                "Resource": [
                    "arn:aws:s3:::log-target-bucket-xyz",
                    "arn:aws:s3:::log-target-bucket-xyz/*"
                ],
                "Condition": {
                    "NotIpAddressIfExists": {
                        "aws:SourceIp": [
                            "10.0.0.1",
                            "10.0.0.2"
                        ]
                    },
                    "StringNotEqualsIfExists": {
                        "aws:sourceVpce": "vpce-1234xyz",
                        "aws:username": "xyz-user"
                    }
                }
            }
        ]
    }

This is very well explained in this question's s3-bucket-security-open-access-restricted-by-public-ip-and-vpc-endpoint