IAM Policy Conditions: IP Address Restriction for S3
Exhibit
Refer to the exhibit.
IAM Policy:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": "s3:GetObject",
"Resource": "arn:aws:s3:::example-bucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "192.0.2.0/24"
}
}
}
]
}Refer to the exhibit. An IAM user has this policy attached. The user tries to download an object from the S3 bucket using the AWS CLI from an on-premises server with IP address 198.51.100.50. What will happen?
Quick Answer
The answer is that the request will fail because the user's IP is not in the allowed range. This outcome is determined by the IAM policy condition that explicitly restricts s3:GetObject access to a specific IP address range, and since the on-premises server at 198.51.100.50 falls outside that range, the condition is not met and the request is denied. On the AWS Certified Security Specialty SCS-C02 exam, this scenario tests your understanding of how IAM IP conditions work for S3 access, often appearing as a trick where examinees overlook the condition key or confuse it with other controls like MFA or HTTPS enforcement. A common trap is assuming that an allow action alone grants access, but the condition block is the gatekeeper—if the IP doesn't match, the entire statement evaluates to deny. Remember the memory tip: "IP first, then action" to check the condition before assuming the permission is granted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The request will fail because the user's IP is not in the allowed range.
The policy includes a condition that restricts access to only requests originating from a specific IP address range. Since the user's on-premises server IP (198.51.100.50) is not within that allowed range, the request will be denied. Option A is incorrect because the policy does not grant unconditional access; the condition overrides the Allow effect. Option B is incorrect because the policy does not require HTTPS; it only checks the source IP. Option D is incorrect because there is no MFA condition in the policy.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The request will succeed because the policy allows s3:GetObject.
Why it's wrong here
The policy has a condition that restricts IP.
- ✗
The request will fail because the user must use HTTPS.
Why it's wrong here
No HTTPS condition is present.
- ✓
The request will fail because the user's IP is not in the allowed range.
Why this is correct
The condition restricts to 192.0.2.0/24.
- ✗
The request will fail because the user must use MFA.
Why it's wrong here
No MFA condition is present.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 376 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SCS-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from 'example-bucket' from an IP address of 10.1.1.1. What will happen?
easy- A.Access is denied because the policy does not include an explicit deny
- B.Access is allowed because the condition key is misspelled
- ✓ C.Access is denied because the IP address is not in the allowed range
- D.Access is allowed because the policy allows s3:GetObject
Why C: The condition restricts access to the IP range 10.0.0.0/16, and the user's IP is outside that range, so access is denied. Option A is incorrect because the policy does not need an explicit deny; the condition fails, resulting in an implicit deny. Option B is incorrect because the condition key is valid and misspelling would not cause this behavior. Option D is incorrect because the policy allows s3:GetObject only if the condition is met, which it is not.
Variation 2. A security engineer attaches this policy to an IAM user. The user tries to download an object from the bucket from an IP address 10.1.0.5. What will happen?
hard- ✓ A.The user will be denied access because the condition does not match
- B.The user will be allowed access because the policy allows s3:GetObject
- C.The policy is invalid and will cause an error
- D.The user will be denied access because there is an explicit deny
Why A: The condition in the policy restricts access to IP addresses within the 10.0.0.0/16 range. The user's IP address 10.1.0.5 is not in that range, so the allow statement for s3:GetObject does not apply. Since there is no applicable allow statement, the default implicit deny takes effect, resulting in denied access. Option B is wrong because the allow only applies when the condition is satisfied. Option C is wrong because the policy is syntactically valid. Option D is wrong because there is no explicit deny statement; the denial is implicit.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.