如何限制S3 Bucket仅允许特定客户端IP上传？权限拒绝问题排查

问题根源 #

你的S3桶策略通过NotIpAddress拒绝了所有非指定IP（203.0.113.45/32）的请求，但日志中显示PUT请求来自AWS内部IP（15.236.X.X），这是因为上传对象触发的Lambda函数在执行时会向S3发起请求——Lambda运行在AWS基础设施中，其请求源IP属于AWS服务IP范围，因此被桶策略拒绝，最终导致AccessDenied错误。

解决方案 #

要实现「仅允许特定客户端IP上传，同时允许Lambda访问桶内对象」的需求，需调整桶策略区分客户端直接请求与Lambda服务请求，以下是两种可行方案：

方案1：添加Lambda执行角色的允许规则

直接为Lambda执行角色添加权限，绕过IP限制，同时保留对非指定IP客户端的拒绝规则：

{
    "Version": "2012-10-17",
    "Id": "my_policy_id",
    "Statement": [
        {
            "Sid": "AllowSpecificClientIP",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "203.0.113.45/32"
                }
            }
        },
        {
            "Sid": "AllowLambdaExecutionRole",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[你的AWS账户ID]:role/[Lambda执行角色ARN]"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*"
        },
        {
            "Sid": "DenyNonAllowedRequests",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": "203.0.113.45/32"
                },
                "NotPrincipal": {
                    "AWS": "arn:aws:iam::[你的AWS账户ID]:role/[Lambda执行角色ARN]"
                }
            }
        }
    ]
}

方案2：使用aws:ViaAWSService条件区分请求类型

利用AWS提供的aws:ViaAWSService条件键，精准识别直接来自客户端的请求（aws:ViaAWSService: false）和AWS服务发起的请求（如Lambda），再分别配置权限：

{
    "Version": "2012-10-17",
    "Id": "my_policy_id",
    "Statement": [
        {
            "Sid": "AllowDirectClientRequest",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "203.0.113.45/32"
                },
                "Bool": {
                    "aws:ViaAWSService": "false"
                }
            }
        },
        {
            "Sid": "AllowLambdaAccess",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::[你的AWS账户ID]:role/[Lambda执行角色ARN]"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*"
        },
        {
            "Sid": "DenyAllUnallowedRequests",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::testbucket/*"
        }
    ]
}

额外检查项 #

• 若日志中的PUT请求是你自己的客户端上传请求而非Lambda发起，需确认是否启用了S3 Transfer Acceleration：启用后上传请求会经过AWS边缘节点，源IP会显示为AWS服务IP，此时需关闭Transfer Acceleration，或把AWS边缘节点的IP范围加入允许列表。
• 若你通过VPC端点访问S3，需将VPC的私有IP范围加入aws:SourceIp，或使用aws:SourceVpc条件键限制仅允许指定VPC的请求。

内容的提问来源于stack exchange，提问作者Hashem Sellat