in AWS Cloudformation how to use multiple if statement in NotIpAddress condition in s3 bucket policy

Question

Having a requirement wherein I have to create a Cloudformation stack set which will create a S3 bucket in multiple AWS regions.

But the problem here is I want to whitelist an IP address in all the S3 buckets in all AWS region and this IP address will be different for each AWS region.

So, I have defined multiple parameters which will take an IP address from the users. Also I have defined a condition for its AWS region. So, lets say if the stack which is getting deployed via stackset is in us-east-1 region, then the condition for us-east-1 will return true. Now, I am giving "!if" statement in S3 bucket policy so that if the stack is getting deployed in us-east-1 region then that particular is statement will be executed.

Below is the S3 bucket policy condition:-

Condition: 
              NotIpAddress:
                aws:SourceIp:
                  - !If [IsUSEast1, !Ref S3IPAddressUSEast1ToWhitelist, !Ref "AWS::NoValue"]
                  - !If [IsUSEast2,      !Ref S3IPAddressUSEast2ToWhitelist,      !Ref "AWS::NoValue"]
                  - !If [IsUSWest1,      !Ref S3IPAddressUSWest1ToWhitelist,      !Ref "AWS::NoValue"]
                  - !If [IsUSWest2,      !Ref S3IPAddressUSWest2ToWhitelist,      !Ref "AWS::NoValue"]
                  - !If [IsEUCentral1,   !Ref S3IPAddressEUCentral1ToWhitelist,   !Ref "AWS::NoValue"]
                  - !If [IsEUWest1,      !Ref S3IPAddressEUWest1ToWhitelist,      !Ref "AWS::NoValue"]

As you can see above if the Cloudformation stack which is getting deployed is in us-east-1 region then 1st "!if" statement will be executed and it will use "S3IPAddressUSEast1ToWhitelist" parameter. But this is not working in my case and it seems that "aws:SourceIp" is only allowing one "!if" statement to execute. Also I tried various other approaches like mappings but here we cannot use !Ref function to assign our parameters into mappings.

If anybody can help to resolve this issue then I would be very glad.

stijndepestel stijndepestel · Accepted Answer · 2021-07-30T13:38:54

You should use a CloudFormation map for this:

Mappings: 
  IPAddresses: 
    us-east-1: 
      IP: 0.0.0.0
    us-east-2: 
      IP: 1.1.1.1.
    [...]: 
      IP: ...

You can then retrieve the value using

!FindInMap [IPAddresses, !Ref "AWS::Region", IP]

More info can be found here.

(Edit)

If you want to use parameters for the value of the IP address, you can simply use a single parameter and override the parameter value depending on where you deploy. More info can be found here.

in AWS Cloudformation how to use multiple if statement in NotIpAddress condition in s3 bucket policy

1 Answers