Combining two s3 polices for static web site

Question

I have S3 Static web site hosting internal web site. I Found a policy document provided by aws which will give read-only access to public and I have a policy which will allow S3 web site to specific IP's. When I combine I am getting an invalid policy document error.

        {
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "DenyPublicReadACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicReadGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
        ],
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListACL",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": [
                    "public-read",
                    "public-read-write",
                    "authenticated-read"
                ]
            }
        }
    },
    {
        "Sid": "DenyPublicListGrant",
        "Effect": "Deny",
        "Principal": {
            "AWS": "*"
        },
        "Action": "s3:PutBucketAcl",
        "Resource": "arn:aws:s3:::Examplebucket",
        "Condition": {
            "StringLike": {
                "s3:x-amz-grant-read": [
                    "*http://acs.amazonaws.com/groups/global/AllUsers*",
                    "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
                ]
            }
        }
    }
]

}

    {
    "Version": "2012-10-17",
     "Id": "S3PolicyIPRestrict",
      "Statement": [
    {
        "Sid": "IPAllow",
        "Effect": "Allow",
        "Principal": {
            "AWS": "*" 
        },
        "Action": "s3:*",
        "Resource": "arn:aws:s3:::Examplebucket/*",
        "Condition" : {
            "IpAddress" : {
                "aws:SourceIp": "192.168.143.0/24" 
            },
            "NotIpAddress" : {
                "aws:SourceIp": "192.168.143.188/32" 
            } 
        } 
       } 
      ]
       }       

Combining both policy statements giving an invalid policy statement

Answer 1

If you want everyone to be able to access your website and full bucket access from a certain IP, here is an example:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "PublicReadGetObject",
         "Effect": "Allow",
         "Principal": "*",
         "Action": [
            "s3:GetObject"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*"
      },
      {
         "Sid": "IPAllowFullAccess",
         "Effect": "Allow",
         "Principal": "*",
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            }
         }
      }
   ]
}

Regarding your question about combining policies: You cannot add two policies, but can combine multiple statements. An example just to show how you would combine policies:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "DenyPublicReadACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicReadGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": [
            "s3:PutObject",
            "s3:PutObjectAcl"
         ],
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListACL",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringEquals": {
               "s3:x-amz-acl": [
                  "public-read",
                  "public-read-write",
                  "authenticated-read"
               ]
            }
         }
      },
      {
         "Sid": "DenyPublicListGrant",
         "Effect": "Deny",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:PutBucketAcl",
         "Resource": "arn:aws:s3:::Examplebucket",
         "Condition": {
            "StringLike": {
               "s3:x-amz-grant-read": [
                  "*http://acs.amazonaws.com/groups/global/AllUsers*",
                  "*http://acs.amazonaws.com/groups/global/AuthenticatedUsers*"
               ]
            }
         }
      },
      {
         "Sid": "IPAllow",
         "Effect": "Allow",
         "Principal": {
            "AWS": "*"
         },
         "Action": "s3:*",
         "Resource": "arn:aws:s3:::Examplebucket/*",
         "Condition": {
            "IpAddress": {
               "aws:SourceIp": "192.168.143.0/24"
            },
            "NotIpAddress": {
               "aws:SourceIp": "192.168.143.188/32"
            }
         }
      }
   ]
}