Web应用防火墙是您的朋友。

Web Application Firewall is your friend.

http：// docs.aws.amazon.com/waf/latest/developerguide/web-acl-ip-conditions.html

使用IP地址创建规则并其余的 WAF会注意。

Create your rule with your IP Addresses and rest "WAF" will take care.

您需要将其应用于所需的CloudFront发行版。

You need to apply this to the required CloudFront Distribution.

您可以将您的存储桶策略限制为CloudFront并通过CloudFront限制为所需的IP。

You can restrict your bucket policies to CloudFront and restrict to your required IP's through CloudFront.