---
title: Managing bucket permissions for IP addresses or ranges of IP
description: Manage bucket permissions based on IP addresses in Scaleway Object Storage.
tags: object storage bucket ip permission
dates:
  validation: 2025-07-31
  posted: 2021-05-18
---
import Requirements from '@macros/iam/requirements.mdx'


When a bucket policy is present in a bucket, any action that is not explicitly allowed is denied by default. You can stipulate which IP addresses or IP ranges have access or permission to perform operations on your buckets by creating a [bucket policy](/object-storage/api-cli/bucket-policy/) with the `IpAddress` or `NotIpAddress` conditions.

It is possible to allow actions for a specific IP address or range of IPs using the `IpAddress`/`NotIpAddress` condition, and the `aws:SourceIp` condition key.

<Message type="note">
  - The `aws:SourceIp` IPv4 and IPv6 values use the standard [CIDR notation](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing). 
  
  - For IPv6, the double colon (`::`) represents one or more groups of consecutive `0`.
</Message>

<Requirements />

- A Scaleway account logged into the [console](https://console.scaleway.com)
- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization
- A valid [API key](/iam/how-to/create-api-keys/)
- An [Object Storage bucket](/object-storage/how-to/create-a-bucket/)


In the example below, we allow the `192.0.2.0/24` IP range to perform the `s3:ListBucket` and `s3:GetObject` actions.

```json
{
  "Version": "2023-04-17",
  "Id": "MyBucketPolicy",
  "Statement": [
    {
      "Sid": "Grant List and GET to specified IP",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": ["<BUCKET_NAME>", "<BUCKET_NAME>/*"],
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "198.51.100.0/24"
        }
      }
    }
  ]
}
```

Alternatively, you can block certain IP addresses or IP address ranges from performing actions on your bucket using the `NotIpAddress` condition:

```json
{
  "Version": "2023-04-17",
  "Id": "MyBucketPolicy",
  "Statement": [
    {
      "Sid": "Grant List and GET to everyone except specified IP",
      "Effect": "Allow",
      "Principal": "*",
      "Action": ["s3:ListBucket", "s3:GetObject"],
      "Resource": ["<BUCKET_NAME>", "<BUCKET_NAME>/*"],
      "Condition": {
        "NotIpAddress": {
          "aws:SourceIp": "2001:db8::/32"
        }
      }
    }
  ]
}
```

<Message type="note">
  Refer to the [dedicated documentation](/object-storage/api-cli/bucket-policy/) on bucket policies syntax for more information.
</Message>