Amazon S3 objects: is it possible to restrict public read policy to some IP adresses only ?

Question

A have a bucket with a public read policy. Now I want to restrict access to some of the objects in order to be accessible only from some IP adresses. Is this possible?

I also plan to add CloudFront. What should I do to keep the same settings on each object?

Thanks!

Ruchit Rami · Accepted Answer · 2013-04-26 04:19:27Z

5

You can use S3 bucket policy. But instead of individual files it will be applied to individual folders in the bucket. You can use policy like the following:

  {
        "Version": "2008-10-17",
        "Id": "testPolicy",
        "Statement": [

            {
                "Sid": "1",
                "Effect": "Allow",
                "Principal": {
                    "AWS": "*"
                },
                "Action": "s3:GetObject",
                "Resource": "arn:aws:s3:::bucketname/subfolder/subfolder2/*",
                "Condition": {
                    "IpAddress": {
                        "aws:SourceIp": [
                            "xxx.xxx.xxx.xxx/xx",
                            "xxx.xxx.xxx.xxx/xx"
                        ]
                    }
                }
            }
        ]
    }

User your bucket name and folder names, and IPs.

Note: Please try it first on a non production bucket.

edited Apr 26, 2013 at 4:19

answered Jan 31, 2013 at 9:48

Ruchit Rami

2,2824 gold badges29 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Dorian Over a year ago

Ok thanks for the response. However I really need to work on each file and not on folders. Is there any way to update directly the ACL of the object in order to restrict access to some IP adresses ?

Mike Brant Over a year ago

@Dorian It is basically the same thing, but rather than having a statement with a wildcard value in the Resource definition, you would have multiple statements, each specifically referring to the exact resource you want the policy to apply to.

Ruchit Rami Over a year ago

@Dorian As Mike has pointed out you can define it for individual objects also. My mistake in not stating that.

Collectives™ on Stack Overflow

Amazon S3 objects: is it possible to restrict public read policy to some IP adresses only ?

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related