Amazon: Denies access to Amazon based on the source IP - Amazon Identity and Access Management
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon: Denies access to Amazon based on the source IP

This example shows how you might create an identity-based policy that denies access to all Amazon actions in the account when the request comes from principals outside the specified IP range. The policy is useful when the IP addresses for your company are within the specified ranges. In this example, the request will be denied unless it originates from the CIDR range or The policy does not deny requests made by Amazon services using Forward access sessions as the original requester’s IP address is preserved.

Be careful using negative conditions in the same policy statement as "Effect": "Deny". When you do, the actions specified in the policy statement are explicitly denied in all conditions except for the ones specified.


This policy does not allow any actions. Use this policy in combination with other policies that allow specific actions.

When other policies allow actions, principals can make requests from within the IP address range. An Amazon service can also make requests using the principal's credentials. When a principal makes a request from outside the IP range, the request is denied.

For more information about using the aws:SourceIp condition key, including information about when aws:SourceIp may not work in your policy, see Amazon global condition context keys.

{ "Version": "2012-10-17", "Statement": { "Effect": "Deny", "Action": "*", "Resource": "*", "Condition": { "NotIpAddress": { "aws:SourceIp": [ "", "" ] } } } }