Why my AWS S3 policy will not restrict access for only certain IP addresses?

Question

I am working on creating an S3 policy in AWS. The S3 stores a mp4 video. I have started the Access based on username or password but when I try to Restricted IPs access (only want to have this video to be accessed from certain IP address only my home and office IP address).

I used myipaddress.com and looked up the "IPconfig" feature in cmd to come up with subnet mask code ( /19, but some use /32, /24 etc)but when I use another IP address it allows the video to be used. In other words, anyone an view this video and I am unable to restrict access. Below is the policy code.

{
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Deny",
                "Action": [
                    "s3:PutAnalyticsConfiguration",
                    "s3:GetObjectVersionTagging",
                    "s3:DeleteAccessPoint",
                    "s3:CreateBucket",
                    "s3:GetStorageLensConfigurationTagging",
                    "s3:ReplicateObject",
                    "s3:GetObjectAcl",
                    "s3:GetBucketObjectLockConfiguration",
                    "s3:DeleteBucketWebsite",
                    "s3:DeleteJobTagging",
                    "s3:PutLifecycleConfiguration",
                    "s3:GetObjectVersionAcl",
                    "s3:PutBucketAcl",
                    "s3:PutObjectTagging",
                    "s3:DeleteObject",
                    "s3:DeleteObjectTagging",
                    "s3:GetBucketPolicyStatus",
                    "s3:GetObjectRetention",
                    "s3:GetBucketWebsite",
                    "s3:GetJobTagging",
                    "s3:DeleteStorageLensConfigurationTagging",
                    "s3:PutReplicationConfiguration",
                    "s3:DeleteObjectVersionTagging",
                    "s3:PutObjectLegalHold",
                    "s3:GetObjectLegalHold",
                    "s3:GetBucketNotification",
                    "s3:PutBucketCORS",
                    "s3:DeleteBucketPolicy",
                    "s3:GetReplicationConfiguration",
                    "s3:ListMultipartUploadParts",
                    "s3:PutObject",
                    "s3:GetObject",
                    "s3:PutBucketNotification",
                    "s3:DescribeJob",
                    "s3:PutBucketLogging",
                    "s3:PutObjectVersionAcl",
                    "s3:GetAnalyticsConfiguration",
                    "s3:PutBucketObjectLockConfiguration",
                    "s3:GetObjectVersionForReplication",
                    "s3:PutAccessPointPolicy",
                    "s3:GetStorageLensDashboard",
                    "s3:CreateAccessPoint",
                    "s3:GetLifecycleConfiguration",
                    "s3:GetInventoryConfiguration",
                    "s3:GetBucketTagging",
                    "s3:PutAccelerateConfiguration",
                    "s3:DeleteObjectVersion",
                    "s3:GetBucketLogging",
                    "s3:ListBucketVersions",
                    "s3:ReplicateTags",
                    "s3:RestoreObject",
                    "s3:ListBucket",
                    "s3:GetAccelerateConfiguration",
                    "s3:GetBucketPolicy",
                    "s3:PutEncryptionConfiguration",
                    "s3:GetEncryptionConfiguration",
                    "s3:GetObjectVersionTorrent",
                    "s3:AbortMultipartUpload",
                    "s3:PutBucketTagging",
                    "s3:GetBucketRequestPayment",
                    "s3:DeleteBucketOwnershipControls",
                    "s3:GetAccessPointPolicyStatus",
                    "s3:UpdateJobPriority",
                    "s3:GetObjectTagging",
                    "s3:GetMetricsConfiguration",
                    "s3:GetBucketOwnershipControls",
                    "s3:DeleteBucket",
                    "s3:PutBucketVersioning",
                    "s3:PutObjectAcl",
                    "s3:GetBucketPublicAccessBlock",
                    "s3:ListBucketMultipartUploads",
                    "s3:PutBucketPublicAccessBlock",
                    "s3:PutMetricsConfiguration",
                    "s3:PutStorageLensConfigurationTagging",
                    "s3:PutBucketOwnershipControls",
                    "s3:PutObjectVersionTagging",
                    "s3:PutJobTagging",
                    "s3:UpdateJobStatus",
                    "s3:GetBucketVersioning",
                    "s3:GetBucketAcl",
                    "s3:BypassGovernanceRetention",
                    "s3:PutInventoryConfiguration",
                    "s3:GetObjectTorrent",
                    "s3:ObjectOwnerOverrideToBucketOwner",
                    "s3:GetStorageLensConfiguration",
                    "s3:DeleteStorageLensConfiguration",
                    "s3:PutBucketWebsite",
                    "s3:PutBucketRequestPayment",
                    "s3:PutObjectRetention",
                    "s3:GetBucketCORS",
                    "s3:PutBucketPolicy",
                    "s3:DeleteAccessPointPolicy",
                    "s3:GetBucketLocation",
                    "s3:GetAccessPointPolicy",
                    "s3:ReplicateDelete",
                    "s3:GetObjectVersion"
                ],
                "Resource": "arn:aws:s3:::internshipbucket12",
                "Condition": {
                    "IpAddress": {
                        "aws:SourceIp": "96.70.32.38/19"
                    }
                }
            },
            {
                "Sid": "VisualEditor1",
                "Effect": "Deny",
                "Action": [
                    "s3:ListStorageLensConfigurations",
                    "s3:GetAccessPoint",
                    "s3:PutAccountPublicAccessBlock",
                    "s3:GetAccountPublicAccessBlock",
                    "s3:ListAllMyBuckets",
                    "s3:ListAccessPoints",
                    "s3:ListJobs",
                    "s3:PutStorageLensConfiguration",
                    "s3:CreateJob"
                ],
                "Resource": "*",
                "Condition": {
                    "IpAddress": {
                        "aws:SourceIp": "96.70.32.38/19"
                    }
                }
            }
        ]
}

Answer 1

anyone an view this video and I am unable to restrict access.

This is not how it works. Your policy is IAM policy , not bucket policy. This means that only IAM users and roles with explicit allow that you enabled can access the videos. Your policy does not allow anonymous access.

Also your denies will apply only to requests coming from 96.70.32.38/19 address. If you are going to use different IP, the polices do not apply. For deny to apply to all other IP addresses, except your own, you need NotIpAddress , rather then IpAddress in the Condition as explained in AWS docs . In addition, your first statement will apply to bucket only , not its objects. For both objects and buckets you need:

 "Resource": [
      "arn:aws:s3:::internshipbucket12",
      "arn:aws:s3:::internshipbucket12/*",
  ]

Also, buckets and objects by default are private . So you don't need to use your IAM policies with explicit denies. By default no one can access the bucket and its contents, unless you as an admin, allow this in the policies.