6

I would like to be able to restrict access to files in a S3 bucket in multiple ways. This is due to the fact that the files stored can be accessed in different manners. We do this because we have TBs of files, so we don't want to duplicate the bucket.

One access method is through tokenized CDN delivery which uses the S3 bucket as a source. So that the files may be pulled, I've set the permissions for the files to allow download for everybody. Using a bucket policy, I can restrict IP addresses which can get the files in the bucket. So I've restricted them to the CDN IP block and anyone outside those IP addresses can't grab the file.

The other is access method is by direct downloads using our store system which generates S3 time expiring pre-signed URLS.

Since the CDN pull effectively needs the files to be publicly readable, is there a way to:

  1. Check first for a valid pre-signed URL and serve the file if the request is valid

  2. If not valid, fall back to the IP address restriction to prevent further access?

I've got a working IP restriction bucket policy working, but that stomps out the pre-signed access...removing the bucket policy fixes the pre-signed access but then the files are public.

4
  • 1
    If removing the IP restriction policy allows all the files to be downloaded, then the signed URLs are not working as intended -- because it sounds like the individual objects are public anyway. They shouldn't be. Done correctly, it's a simple matter of allowing anonymous access from the whitelisted IPs, instead of denying access from "not" the whitelisted IPs. Mar 12, 2016 at 0:27
  • Could you clarify whether your CDN is CloudFront, or is it something else? The reason is that CloudFront supports an Object Access Identity that can specifically permit CloudFront to access an S3 bucket. Mar 12, 2016 at 1:37
  • It is very strange that you say the IP restriction "stomps out the pre-signed access" -- that should not be possible. Can you provide a (redacted) copy of the policies you have created? Mar 12, 2016 at 1:41
  • The fact that I was using a deny in the IP address was the problem...thanks for the insights on this, Michael. I've listed my final code below for those who run into this in the future.
    – johnmontfx
    Mar 12, 2016 at 15:51

2 Answers 2

10

Objects in Amazon S3 are private by default. Access then can be granted via any of these methods:

  • Per-object ACLs (mostly for granting public access)
  • Bucket Policy with rules to define what API calls are permitted in which circumstances (eg only from a given IP address range)
  • IAM Policy -- similar to Bucket Policy, but can be applied to specific Users or Groups
  • A Pre-signed URL that grants time-limited access to an object

When attempting to access content in Amazon S3, as long as any of the above permit access, then access is granted. It is not possible to deny access via a different method -- for example, if access is granted via a pre-signed URL, then a Bucket Policy cannot cause that access to be denied.

Therefore, the system automatically does what you wish... If the pre-signed URL is valid, then access is granted. If the IP address comes from the desired range, then access is granted. It should work correctly.

It is very strange that you say the IP restriction "stomps out the pre-signed access" -- that should not be possible.

2
  • Thank you so much -- this and another post helped me quite a bit. My problem was that I was using a deny to deny any IP addresses that weren't listed in my policy. A deny always overrides an allow, so that's what was happening. Tweaking my code to what is above fixed the situation.
    – johnmontfx
    Mar 12, 2016 at 15:49
  • @johnmontfx Was the PowerUser able to upload documents after these changes? Jun 30, 2022 at 2:27
1

Issue solved -- here's what I ended up with. I realized I was using a "deny" for the IP Address section (saw that code posted somewhere, which worked on it's own) which does override any allows, so I needed to flip that.

I also made sure I didn't have any anonymous permissions on objects in the buckets as well.

{
"Version": "2012-10-17",
"Id": "S3PolicyId2",
"Statement": [
    {
        "Sid": "Allow our access key",
        "Effect": "Allow",
        "Principal": {
            "AWS": "arn:aws:iam::123456789:user/myuser"
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::mybucket/*"
    },
    {
        "Sid": "IPAllow",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": "arn:aws:s3:::mybucket/*",
        "Condition": {
            "IpAddress": {
                "aws:SourceIp": [
                    "192.168.0.1/27",
                    "186.168.0.1//32",
                    "185.168.0.1/26"
                ]
            }
        }
    }
]
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.