S3 Bucket Policy aws:SourceIp Not Working with IAM Role — Troubleshooting

Exhibit

Refer to the exhibit.
```
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AdminRole"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::my-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/16"
        }
      }
    }
  ]
}
```

Refer to the exhibit. A security engineer creates the S3 bucket policy above to allow an IAM role to upload objects only from the corporate network IP range (10.0.0.0/16). However, users report that they can still upload objects from outside the range when assuming the role. What is the most likely cause?

Quick Answer

The answer is that the bucket policy uses Allow instead of Deny, so an explicit Deny is required to block uploads that fail the IP condition. When an IAM role has its own IAM policy that grants s3:PutObject without any IP restriction, that unconditional Allow from the role’s policy remains in effect. The bucket policy’s conditional Allow statement simply does not apply when the source IP is outside 10.0.0.0/16, but because there is no explicit Deny, the role’s IAM policy still permits the upload. This is a classic trap on the AWS Certified Security Specialty SCS-C02 exam: resource-based policies like S3 bucket policies only override IAM permissions when they explicitly deny, not when they conditionally allow. The aws:SourceIp condition key works correctly with IAM roles—it checks the client’s IP—but it must be paired with a Deny effect to enforce the restriction. Memory tip: “Allow is a door that can be left open; Deny is the lock that keeps it shut.”

⚠ Common exam trap

A common mix-up: candidates assume an Allow with a condition implicitly denies all other requests, but AWS policy evaluation requires an explicit Deny to block access that does not meet the condition.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.

An S3 bucket policy with an Allow effect grants access to anyone who meets the condition, but it does not explicitly deny requests that do not meet the condition. In IAM and resource-based policies, an Allow that includes a condition only applies when the condition is true; if the condition is false, the Allow is not evaluated, but other policies (like the IAM role's permissions) may still grant access. To block uploads from outside the corporate IP range, an explicit Deny with the same condition (or a NotIpAddress condition) is required to override any other Allow that might apply.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The condition key aws:SourceIp does not support the IP range 10.0.0.0/16 because it is a private IP range.
Why it's wrong here
aws:SourceIp works with any IP range, including private.
✓
The bucket policy uses Allow instead of Deny; an explicit Deny is needed to block requests that do not meet the condition.
Why this is correct
Because the IAM role already has an Allow, an Allow with condition does not restrict; a Deny is required.
✗
The IAM role's trust policy does not restrict who can assume the role.
Why it's wrong here
Trust policy restricts who can assume, but does not affect the condition evaluation.
✗
The resource ARN should not include the trailing /*.
Why it's wrong here
The trailing /* is correct for object-level permissions.

Quick reference

AWS S3 Storage Class Comparison

Storage Class	Min Duration	Retrieval	Use Case
S3 Standard	None	Immediate	Frequently accessed data
S3 Standard-IA	30 days	Immediate	Infrequent access, rapid retrieval
S3 One Zone-IA	30 days	Immediate	Non-critical infrequent data
S3 Intelligent-Tiering	None	Immediate–hours	Unknown or changing access patterns
S3 Glacier Instant	90 days	Milliseconds	Archive with instant retrieval
S3 Glacier Flexible	90 days	Minutes–hours	Archive, flexible retrieval
S3 Glacier Deep Archive	180 days	Hours	Long-term compliance archive

Go deeper

1 more way this is tested on SCS-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A security engineer reviews the above IAM policy attached to an IAM user. The user reports that they cannot download objects from the S3 bucket 'example-bucket' when connected from the office network (IP range 10.0.0.0/16). What is the most likely cause?

hard

A.The bucket policy overrides the IAM policy
B.The policy does not allow the s3:GetObject action
✓ C.The source IP condition does not match the user's actual IP address
D.The user is not assuming the correct IAM role

Why C: The IAM policy includes a `Condition` block using `aws:SourceIp` that restricts allowed IP addresses to the range 10.0.0.0/16. If the user's actual office network IP address falls outside this range (e.g., due to NAT or a different subnet), the condition fails, and the `s3:GetObject` action is denied, even though the user has the necessary permissions in the `Action` field.

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.