S3 Bucket Policy Project 4: Office Source IP Restrict

By Ravindra Bagale, trainer · LinkedIn · Last updated: 28 October 2026

1. Story

Nisha Patel (अहमदाबाद) व Omar Al-Farsi (Dubai) CSVs. Home IP + leaked key = deny.

2. Source IP का?

हे का लागतं?

Stolen keys random IP वर fail. Office/VPN CIDR allow-list.

• Stable CIDRs
• Deny-unless IP
• CF pitfall
• VPN better long-term

3. Policy

हे काय आहे?

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnlessOfficeIp",
      "Effect": "Deny",
      "Principal": "*",
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::rb-finance-office-ap-south-1",
        "arn:aws:s3:::rb-finance-office-ap-south-1/*"
      ],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": [
            "203.0.113.10/32",
            "203.0.113.0/28",
            "198.51.100.20/32"
          ]
        },
        "Bool": { "aws:ViaAWSService": "false" }
      }
    }
  ]
}

Line-by-line

1. NotIpAddress.
2. CIDR list.
3. VPN NAT.
4. ViaAWSService.
5. Both ARNs.
6. IAM Allow.

4. CLI

कसं करायचं (step by step)

# Discover your egress IP from office
curl -s https://checkip.amazonaws.com
# 203.0.113.10

aws s3api put-bucket-policy --bucket rb-finance-office-ap-south-1 --policy file://office-ip.json
# (empty success)

5. Allow/deny

# ALLOW — on office network
aws s3 ls s3://rb-finance-office-ap-south-1/
# PRE exports/

# DENY — phone hotspot / home
aws s3 ls s3://rb-finance-office-ap-south-1/
# An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

6. Multi-industry

Manufacturing, CA, trading, legal.

7. AccessDenied debugging आणि Policy Simulator

AccessDenied क्रम: BPA → bucket Deny → IAM Allow → KMS → VPCe → ACL. Simulator BPA/VPC/KMS miss करू शकतो — खऱ्या CLI ने test.

# Decode
aws s3api get-bucket-policy --bucket BUCKET --query Policy --output text | python3 -m json.tool
aws s3api get-public-access-block --bucket BUCKET
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names s3:GetObject --resource-arns arn:aws:s3:::BUCKET/key.txt
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=GetObject --max-items 5

8. Lab: office IP

Org block नसेल तर ap-south-1 (Mumbai). आधी budget alert.

कसं करायचं (step by step)

1. Record IP.
2. Allow test.
3. Deny test.
4. Second CIDR.

Cleanup (billing थांबवा)

1. Cleanup.
2. IAM cleanup.

9. सामान्य errors आणि fixes

प्रत्येक row = खरी चूक. Panic करण्याआधी fix वाचा.

10. Troubleshooting checklist

1. Region + endpoint.
2. Policy + BPA.
3. Lab user.
4. Sid binary search.
5. CloudTrail.
6. KMS test.
7. VPCe path.
8. Lock cleanup.

11. FAQ

12. Interview Q&A

13. Tips — English, मराठी आणि हिंदी

14. Policy save करण्याआधी checklist

1. Business rule एका वाक्यात.
2. Allow vs Deny-unless; Deny wins.
3. ARN shapes.
4. Condition keys.
5. BPA first.
6. Allow+deny plan.
7. Cleanup plan.
8. json.tool.

15. Policy Simulator walkthrough

Simulator identity/resource typos साठी चांगला; BPA/VPCe/KMS miss होऊ शकतात. नंतर खऱ्या path वरून CLI.

1. Simulator → user/role.
2. Action + ARN.
3. Include bucket policy.
4. CLI confirm.
5. Mismatch → layers.

16. Copy-paste runbook

# 0) Region + names
export AWS_REGION=ap-south-1
export BUCKET=rb-lab-$(date +%s)-ap-south-1

# 1) Create + show BPA
aws s3api create-bucket --bucket $BUCKET --region $AWS_REGION \
  --create-bucket-configuration LocationConstraint=$AWS_REGION
aws s3api get-public-access-block --bucket $BUCKET || true

# 2) Validate + apply policy
python3 -m json.tool policy.json >/dev/null
aws s3api put-bucket-policy --bucket $BUCKET --policy file://policy.json
aws s3api get-bucket-policy --bucket $BUCKET --query Policy --output text | python3 -m json.tool | head

# 3) Allow test + Deny test (fill per project)
# ... project-specific curls / aws s3 cp ...

# 4) Cleanup
aws s3 rm s3://$BUCKET --recursive || true
aws s3api delete-bucket-policy --bucket $BUCKET || true
aws s3api delete-bucket --bucket $BUCKET

17. Industry story bank

वरील प्रत्येक project एक industry story वापरतो. इतर industries मध्ये फक्त bucket/principal/Condition बदला.

• Healthcare: SSE-KMS + OrgID + MFA.
• Fintech: IP + HTTPS + OAC.
• EdTech: OAC only.
• Logistics: VPCe.
• Media: Object Lock.
• Retail: prefix public read.
• SaaS: prefix homes.
• Gov: OrgID + MFA + Lock.

18. AccessDenied debugging flowchart

1. Error code + request id.
2. Bucket + region.
3. BPA.
4. Explicit Deny.
5. Conditions.
6. KMS key policy.
7. OAC id.
8. VPCe path.
9. Simulator + CLI.
10. Support last.

19. PR review checklist

• Valid JSON.
• Required fields.
• No open write.
• Tests.
• Cleanup.

उजळणी, मुलाखत आणि तुलना cards

हा lesson काही मिनिटांत revise करा. Cards phone वर save करा किंवा PNG download करा. प्रत्येक card वरचा QR हा lesson उघडतो.

अजून cards: Ravi Sir's Cards.