A company stores a file in an S3 bucket containing IP allow/deny lists. The file must be accessible via an HTTP endpoint. Firewalls outside AWS must…

An Amazon S3 bucket policy is the most direct and appropriate mechanism to control access to objects based on the source IP address. By using the aws:SourceIp condition key in the policy, you can explicitly grant s3:GetObject permission to a specific list of IP addresses (the firewalls). This method provides access via the standard S3 HTTP endpoint.

Crucially, a bucket policy that restricts access to a specific set of IP addresses is not considered "public" by the S3 Block Public Access feature. Therefore, this solution is fully compatible with the account-level security setting and meets all requirements efficiently.

A. Hosting as a static website generally requires making objects public, which is prevented by the S3 Block Public Access setting enabled on the account.

C. Origin Access Control (OAC) restricts access to the S3 bucket to the CloudFront distribution itself, not to the end-user's IP address. Filtering user IPs would require AWS WAF, which is not mentioned.

D. Using a Lambda function introduces unnecessary complexity and cost. S3 bucket policies provide a native, simpler, and more direct solution for IP-based access control.

1. AWS S3 Documentation

"Bucket policy examples": This page provides a specific example for "Restricting access to specific IP addresses." It demonstrates using the Condition element with the IpAddress operator and the aws:SourceIp condition key. (See the section: "Restricting access to specific IP addresses").

2. AWS S3 Documentation

"Meaning of 'public'": This document clarifies what S3 Block Public Access considers "public." A policy is not considered public if access is restricted to specific principals

VPCs

or IP addresses. It states

"However

if the policy grants access to a fixed set of IP addresses... the bucket policy is not public." (See the section: "The meaning of 'public'").

3. AWS CloudFront Documentation

"Restricting access to an Amazon S3 origin": This document explains that Origin Access Control (OAC) is used to "secure your S3 content by only allowing access from CloudFront

not directly from S3 URLs." This confirms OAC's role is to secure the origin

not filter viewer requests. (See the introduction section of the document).