Enforcing IP Restrictions | Tigris Object Storage Documentation

On this page

This guide shows you how to restrict access to a bucket using IAM policies that only allow access from specific IP addresses or IP ranges.

Use Case

Grant read-only access to an S3 bucket—but only from trusted IPs such as a corporate VPN or known static address.

Example Policy

The following policy allows listing and reading from the images bucket only if the request comes from the IP address 1.2.3.4 or the CIDR block 203.0.113.0/24.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "IpRestrictedReads1",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::images", "arn:aws:s3:::images/*"],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "1.2.3.4"
        }
      }
    },
    {
      "Sid": "IpRestrictedReads2",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": ["arn:aws:s3:::images", "arn:aws:s3:::images/*"],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "203.0.113.0/24"
        }
      }
    }
  ]
}

Explanation

Field	Description
`Action`	Grants `s3:GetObject` (for reading objects) and `s3:ListBucket` (for listing keys).
`Resource`	Targets both the bucket and the objects within it.
`Condition`	Restricts access to the specified IPs using `IpAddress`.

To deny access from all other IPs, you can use NotIpAddress instead.