Problem:
When a request is made to S3, decide whether a given request should be allowed or denied.
Solution Summary:
Create policies for the allow or deny scenarios.
Prerequisites:
Should have an AWS account and basic familiarity with S3.
Solution Steps:
-
Create a bucket (e.g. buddybucketpolicy) leaving all default selections as is.
-
Create a text file and upload it with default settings.
-
Verify that you get access denied warning when you try to access the file publicly.
-
Go to policy generator and generate policy as per the given policy description or copy paste the given policy json in bucket policy (editor) under Permissions tab.
Examples
Policy 1:
{
"Id": "Policy1500988548299",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500988533386",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "42.109.194.187"
}
},
"Principal": "*"
}
]
}
Description: Allow + IpAddress
Allow from IP 42.109.194.187
Deny from other IP.
Policy 2:
{
"Id": "Policy1500988548299",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500988533386",
"Action": [
"s3:GetObject"
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": "42.109.194.187"
}
},
"Principal": "*"
}
]
}
Description: Allow + NotIpAddress
Deny from IP 42.109.194.187
Allow from other IP.
Policy 3:
{
"Id": "Policy1500988548299",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500988533386",
"Action": [
"s3:GetObject"
],
"Effect": "Deny",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": "42.109.194.187"
}
},
"Principal": "*"
}
]
}
Description: Deny + IpAddress
Deny from IP 42.109.194.187
Deny from other IP.
Policy 4:
{
"Id": "Policy1500988548299",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500988533386",
"Action": [
"s3:GetObject"
],
"Effect": "Deny",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "42.109.194.187"
}
},
"Principal": "*"
}
]
}
Description: Deny + IpAddress
Deny from IP 42.109.194.187
Deny from other IP.
Policy 5:
{
"Id": "Policy1500988548299",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1500988533386",
"Action": [
"s3:GetObject"
],
"Effect": "Deny",
"Resource": "arn:aws:s3:::buddybucketpolicy/*",
"Principal": "*"
}
]
}
Description: (only) Deny
Deny from All IP
Note: Only Allow allows from all IP (Ref=last lab).
Summary
Allow + IpAddress
Allow from IP 42.109.194.187
Deny from other IP.
Allow + NotIpAddress
Deny from IP 42.109.194.187
Allow from other IP.
Deny + IpAddress
Deny from IP 42.109.194.187
Deny from other IP.
Deny + NotIpAddress
Deny from IP 42.109.194.187
Deny from other IP.
(only) Deny
Deny from All IP
Note: Only Allow allows from all IP (Ref=last lab).
Recent comments