How do I add an IP source condition to AWS managed policy in IAM User or Role

Question

I need to add a aws:SourceIp and aws:VpcSourceIp conditions to a Role with only AWS managed policies. What would the CloudFormation template used to create the Role look like? Thanks!

Accepted Answer

This was what I used that worked:

```
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CustomPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CustomIPPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Deny
            Action: "*"
            Resource: "*"
            Condition:
              NotIpAddress:
                aws:SourceIp:
                  - "192.0.2.0/24" # Specify the IP range(s) you want to allow
      Roles:
        - Ref: MyIAMRole

MyIAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: MyRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
              AWS: arn:aws:iam::XXXXXXXXXXXX:user/tester
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - "arn:aws:iam::aws:policy/ReadOnlyAccess"
```

Answer

To add an IP source condition to an AWS managed policy in an IAM Role using CloudFormation, you would typically create a custom managed policy that includes the desired conditions, and then attach that custom policy to the IAM Role. Here's a CloudFormation template to achieve this:

```yaml
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  CustomPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyName: CustomIPPolicy
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Action: "*"
            Resource: "*"
            Condition:
              IpAddress:
                aws:SourceIp:
                  - "192.0.2.0/24" # Specify the IP range(s) you want to allow
              StringEquals:
                aws:SourceVpc: "vpc-1234567890abcdef0" # Specify the VPC ID
      Roles:
        - Ref: MyIAMRole

MyIAMRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: MyRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
```

In this CloudFormation template:

1. We create a custom IAM policy named `CustomIPPolicy` with the desired IP source conditions specified in the `PolicyDocument`.
2. We create an IAM Role named `MyRole` with the `AssumeRolePolicyDocument` specifying the service (in this case, EC2) that can assume this role.
3. We attach the custom policy `CustomIPPolicy` to the IAM Role `MyRole`.

Make sure to replace `"192.0.2.0/24"` with the IP range(s) you want to allow and `"vpc-1234567890abcdef0"` with the VPC ID you want to allow as the source. You can also adjust the actions and resources in the policy statement as per your requirements.

Answer

Hi

Here you can check information of source ip https://repost.aws/knowledge-center/iam-restrict-calls-ip-addresses

Policy CFT Manged - https://repost.aws/knowledge-center/cloudformation-attach-managed-policy

IAM Role with Custom Policy - https://gist.github.com/evnm/e4769f8a5735b9bad62ea209ff14fae2

How do I add an IP source condition to AWS managed policy in IAM User or Role

Relevant content