Restrict S3 Bucket Access to a Specific IP Range
A company's security team is designing a solution to restrict S3 bucket access based on the requester's network. The company has a set of on-premises IP ranges and wants to ensure that only requests originating from those IPs can access the bucket. Which combination of actions should be taken? (Choose TWO.)
Quick Answer
The correct combination is to create an S3 bucket policy using the aws:SourceIp condition key and to configure a VPC endpoint with a policy that restricts access to the specific bucket. This works because the bucket policy directly evaluates the requester’s IP address against your on-premises ranges, blocking any traffic that does not match, while the VPC endpoint policy ensures that even traffic originating inside your VPC—which may appear to come from a NAT gateway’s public IP—can only reach the bucket if it passes through the endpoint and satisfies the same restriction. On the AWS Certified Advanced Networking Specialty ANS-C01 exam, this scenario tests your understanding of how to combine resource-based policies with network-level controls to enforce IP-based access, a common trap being that EC2 instance IPs are ephemeral and cannot be reliably used in a bucket policy. A useful memory tip is “source IP for on-prem, endpoint for in-VPC”—the bucket policy handles external IPs, while the VPC endpoint policy catches internal traffic that might otherwise bypass the IP check.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket
To restrict S3 bucket access based on the requester's network, you can use an S3 bucket policy with the aws:SourceIp condition to allow only requests from specified on-premises IP ranges (option E). However, if requests originate from within a VPC, they might appear to come from the VPC's public IPs (e.g., through a NAT gateway) rather than the on-premises IPs. To handle this, you can create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket (option B). This ensures traffic from the VPC to S3 goes through the endpoint and can be controlled separately. Option A is incorrect because using Elastic IPs does not reliably restrict access; the bucket policy would need to allow specific Elastic IPs, but this does not account for on-premises IPs. Option C is incorrect because AWS WAF is for web application traffic, not S3 bucket access. Option D is incorrect because S3 Block Public Access prevents public access but does not restrict based on the requester's network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the EC2 instances in the VPC to use Elastic IPs and allow those IPs in the bucket policy
Why it's wrong here
Elastic IPs are public IPs but the requirement is to restrict based on on-premises IPs, not EC2 instance IPs.
- ✓
Create a VPC endpoint for S3 and attach a VPC endpoint policy that restricts access to the specific bucket
Why this is correct
This ensures that even if requests originate from the VPC, they must go through the endpoint and be subject to the policy.
- ✗
Use AWS WAF to inspect HTTP requests to the bucket
Why it's wrong here
AWS WAF is for web ACLs on CloudFront or ALB, not directly for S3 bucket access.
- ✗
Enable S3 Block Public Access on the bucket
Why it's wrong here
This blocks all public access but does not restrict based on IP.
- ✓
Create an S3 bucket policy that uses the aws:SourceIp condition to allow access only from the on-premises IP ranges
Why this is correct
This directly restricts access based on source IP.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every ANS-C01 question from scratch — 1,621 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on ANS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to restrict access to their S3 bucket so that only users from their corporate network (with a specific IP range) can read objects. They also want to ensure that the objects are encrypted in transit. Which combination of bucket policy and encryption should they use?
easy- A.Use a VPC endpoint with a bucket policy that restricts access to the VPC endpoint.
- B.Use an IAM policy that restricts access to the corporate IP range and enable default encryption on the bucket.
- ✓ C.Bucket policy with a condition that denies access unless the source IP is within the corporate range, and require HTTPS for all requests.
- D.Enable CloudFront with geographic restrictions and use HTTPS.
Why C: A bucket policy with a condition key `aws:SourceIp` can restrict access to the corporate IP range, and requiring HTTPS (via a `aws:SecureTransport` condition) ensures encryption in transit. This combination directly meets both requirements without relying on additional infrastructure like VPC endpoints or CloudFront.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This ANS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ANS-C01 exam.