AWS IP Whitelisting

Good day, Thank you for your response. I have changed my policy to the following but I still get the same error. In the below I removed my IP's. { "Version": "2012-10-17", "Statement": { "Effect": "Deny", "Action": "", "Resource": "", "Condition": { "NotIpAddress": { "aws:SourceIp": [ "192.168.0.0/24" ] }, "Bool": { "aws:ViaAWSService": "false" }, "StringLike": { "aws:userAgent": "exec-env/CloudShell" } } } }

There is no Allow statement in your IAM policy, so no actions are allowed. So, as an example, if you allow all actions and conditionally deny them as shown below, you can also apply IP restrictions. Basically, it is dangerous to allow "Action": "*", so please use it for testing purposes. Also, try restarting CloudShell once after changing the IAM policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "*",
            "Resource": "*"
        },
        {
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "NotIpAddress": {
                    "aws:SourceIp": [
                        "192.0.2.0/24",
                        "203.0.113.0/24"
                    ]
                },
                "Bool": {"aws:ViaAWSService": "false"},
                "StringNotLike": {
                    "aws:userAgent": "*exec-env/CloudShell*"
                }
            }
        }
    ]
}

Sorry but those Deny statements are dangerously constructed. For example, the latest Deny will not get hit if the request is made via a VPC endpoint, because the aws:SourceIp key is not present in requests made through endpoints. You would need to use the NotIpAddressIfExists, BoolIfExists, and StringNotLikeIfExists variants of the operators, so that each comparison evaluates to "true" when the condition key is absent. Also, the "User-Agent" header can be set freely by any attacker over any path, so it is only opportunistic filtering but no real protection at all.

As shown in the document below, there is an IP address range used by AWS services, so if you use this, you can change CloudShell restrictions to IP address restrictions. However, the following IP address ranges are subject to change, so if you want to completely fix CloudShell's IP address, we recommend connecting to a VPC and communicating via NAT Gateway. https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html