- Newest
- Most votes
- Most comments
Hi, there exist specific conditions in IAM policies to bock ranges of IP addresses. See https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_examples_aws_deny-ip.html
Example from the page:
{
"Version": "2012-10-17",
"Statement": {
"Effect": "Deny",
"Action": "*",
"Resource": "*",
"Condition": {
"NotIpAddress": {
"aws:SourceIp": [
"192.0.2.0/24",
"203.0.113.0/24"
]
},
"Bool": {"aws:ViaAWSService": "false"}
}
}
}
In the example, the blocker is broads with Deny for Action:* and Resource:*. You can tune that to your own use case with more specific actions and resources, depending on what you want to block exactly.
AFAIK, ports can be blocked via security groups but not by IAM policies
You can block HTTP (port 80) requests to services. Example:
{
"Id": "ExamplePolicy",
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSSLRequestsOnly",
"Action": "s3:*",
"Effect": "Deny",
"Resource": [
"arn:aws:s3:::DOC-EXAMPLE-BUCKET",
"arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"
],
"Condition": {
"Bool": {
"aws:SecureTransport": "false"
}
},
"Principal": "*"
}
]
}
Thanks for the answer but if I want to block port for EC2 instance will it be possible using IAM policy?
No. You must use Security Groups (allow only), Network ACLS, or something like a Network Firewall. If you are blocking at the HTTP/HTTPS level, you could use AWS WAF if your front the EC2 Instances with an ALB. AWS IAM is about protecting AWS APIs (authentication and authorization). All of the policy examples above are protecting these APIs, not instances. There is some gray area where you can use IAM policies to control access to Session Manager and the ability to login to an instance, but IAM policies are not network firewall rules.
Relevant content
asked 2 years ago
asked 3 years ago
You can’t block with security groups. You can only allow.
Agree with Gary . To block port, network acl is needed.
@Didier As Gary mentioned, in AWS, you don't explicitly "block" ports using security groups. Instead, you only "allow" specific traffic. By default, a security group denies all inbound traffic and allows all outbound traffic unless rules are added to allow specific types of inbound traffic. I would suggest you update your answer so we don't confuse other users.
what does this line mean? "Bool": {"aws:ViaAWSService": "false"}
and above policy is for blocking specific IP addresses or allow?