How to access Object Storage Service (OSS) from a specified IP address-Resource Access Management(RAM)-阿里云帮助中心

Use the acs:SourceIp global condition key in a Resource Access Management (RAM) policy to restrict OSS access to specific IP addresses or CIDR blocks, using one of two patterns: allowing access only from a trusted network, or blocking all access from outside one.

Scenario 1: allow access only from a trusted CIDR block

Grant a user read access to a specific OSS bucket only when requests originate from a trusted network, such as your corporate network.

Policy example

The following policy allows a user to read objects from the myphotos bucket only when the request originates from the 192.168.0.0/16 or 172.16.0.0/12 CIDR blocks.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss:ListBuckets",
                      "oss:GetBucketStat",
                      "oss:GetBucketInfo",
                      "oss:GetBucketTagging",
                      "oss:GetBucketAcl" 
                      ], 
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ],
            "Condition":{
                "IpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16", "172.16.0.0/12"]
                }
            }
        }
    ]
}

How this policy works

Statement 1 grants read-only permissions to list buckets — required for the user to navigate and see buckets in the OSS console. No IP restriction applies to this statement.
Statement 2 grants permissions to list and get objects in the myphotos bucket. The Condition block with the IpAddress operator restricts this Allow statement: it takes effect only when the source IP matches one of the specified CIDR blocks.

Source IP	Matches CIDR?	Result
`192.168.1.10`	Yes	Allowed
`8.8.8.8`	No	Denied (no matching Allow)

Scenario 2: deny access from outside a trusted CIDR block

This pattern enforces a network perimeter by blocking all OSS access from outside the trusted network, regardless of other permissions the user holds.

Note

Important: The Deny statement in this pattern explicitly blocks all OSS access from outside the trusted CIDR block. An explicit Deny always overrides any Allow — including permissions granted by other policies attached to the same user. If a user accesses OSS from an IP not in the CIDR block, the Deny takes effect and the request is rejected — regardless of the Allow statements or any other permissions the user holds.

Policy example

The following policy explicitly denies all OSS actions when the source IP address is outside the 192.168.0.0/16 CIDR block.

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                      "oss:ListBuckets",
                      "oss:GetBucketStat",
                      "oss:GetBucketInfo",
                      "oss:GetBucketTagging",
                      "oss:GetBucketAcl" 
                      ], 
            "Resource": [
                "acs:oss:*:*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "oss:ListObjects",
                "oss:GetObject"
            ],
            "Resource": [
                "acs:oss:*:*:myphotos",
                "acs:oss:*:*:myphotos/*"
            ]
        },
        {
            "Effect": "Deny",
            "Action": "oss:*",
            "Resource": [
                "acs:oss:*:*:*"
            ],
            "Condition":{
                "NotIpAddress": {
                    "acs:SourceIp": ["192.168.0.0/16"]
                }
            }
        }
    ]
}

How this policy works

Statement 1 grants read-only permissions to list buckets — required for the user to navigate and see buckets in the OSS console. No IP restriction applies to this statement.
Statement 2 grants permissions to list and get objects in the myphotos bucket. Unlike Scenario 1, this Allow statement has no Condition block — access control is enforced entirely by Statement 3's Deny rule.
Statement 3 is a Deny statement using the NotIpAddress operator. The condition is met whenever the source IP falls outside the specified CIDR block, triggering a deny for all OSS actions.

Source IP	Outside CIDR?	`NotIpAddress` condition met?	Result
`192.168.1.10`	No	No	Allowed
`8.8.8.8`	Yes	Yes — Deny fires	Denied