how can i Deny console login if my user is not login from corporate ip range or specific ip ranges

Question

hi,
i want to deny console login if my any i am user performing console login without connecting to VPN or without from allowed IP ranges.
i did tried to put this policy 
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                       "sOURCE_ip_RANGE"
                    ]
                }
            }
        }
    ]
}

if anyone can help me to give me possible solutions to achieve this.

Praveen Muppala · Answer

You could try using this :

[AWS Management Console Private Access](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/console-private-access.html)

[Access accounts with AWS Management Console Private Access](https://aws.amazon.com/blogs/security/access-accounts-with-aws-management-console-private-access/)

rohrober · Answer

What Identity Provider (IdP) are you using? Are you able to filter access by source IPs with it? Keep in mind that implementing such policies may add complexity to your environment.

Riku_Kobayashi · Answer

Hello.

Deny policy alone cannot do anything, so it must be used in conjunction with Allow policy.  
As an example, the following policy allows all operations when accessing from "203.0.113.123/32".  
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html  
```
{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "AdministratorAccess",
        "Effect": "Allow",
        "Action": "*",
        "Resource": "*"
      },
      {
        "Sid": "SourceIPRestriction",
        "Effect": "Deny",
        "Action": "*",
        "Resource": "*",
        "Condition": {
          "NotIpAddress": {"aws:SourceIp": "203.0.113.123/32"}
        }
      }
    ]
  }
```

By the way, "aws:SourceIp" can only be set as a public IP address.  
https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-sourceip

how can i Deny console login if my user is not login from corporate ip range or specific ip ranges

Relevant content