限定子用户只能通过特定的IP访问资源

下面的策略语句可以授予KS3权限，但是请求IP必须来自条件中指定的IP地址范围。

{
  "Version":"2015-11-01",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ks3:GetObject",
        "ks3:ListBucket"
      ],
      "Resource": [
        "krn:ksc:ks3:::example_bucket",
        "krn:ksc:ks3:::example_bucket/*"
      ],
      "Condition": {
        "IpAddress": {
          "ksc:SourceIp": [
            "54.240.144.0/24"
          ]
        },
        "NotIpAddress": {
          "ksc:SourceIp": [
            "54.240.144.188/32"
          ]
        }
      }
    }
  ]
}