cloudscaleKnowledge Base

To restrict access to your bucket (e.g. "my-bucket") to certain IP addresses, create a file as follows and save it locally, e.g. under ip-policy.json:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "IPAllowList",
    "Effect": "Deny",
    "Principal": "*",
    "Action": "*",
    "Resource": [
      "arn:aws:s3:::my-bucket",
      "arn:aws:s3:::my-bucket/*"
    ],
    "Condition": {
      "NotIpAddress": {
        "aws:SourceIp": [
          "<My-IP>",
          "<Host-IP>/<CIDR>"
        ]
      }
    }
  }]
}

Now add this policy to your bucket by means of e.g. the s3cmd tool:

s3cmd setpolicy ip-policy.json s3://my-bucket

In a (separate) statement with "Effect": "Allow" and "IpAddress" (instead of "NotIpAddress"), you can also explicitly allow specific IP addresses.

Caution: By restricting access to certain IP addresses or ranges, there is a risk that you might lock yourself out. We recommend that you first validate the policy on a test bucket.