Restricting AWS API access by source IP address is one of the most common condition patterns in IAM, and nearly all of it comes down to one condition key: aws:SourceIp. IP-Restricted Policy Generator builds an Allow statement scoped by that key, handling the two real-world details that trip people up by hand — choosing the right operator for an allow-list versus a deny-list, and getting the single-value-vs-array shape of the condition value right.
The core choice is a toggle between two IAM condition operators. Allow-list mode uses IpAddress: the statement's permissions apply only when the request's source IP falls inside one of the CIDR ranges you list. Deny-list mode uses NotIpAddress instead: the statement applies when the source IP is outside every listed range — useful when paired with a Deny effect elsewhere (this tool's companion, the Deny Policy Generator, can build that Deny statement) to actively block a specific set of known ranges while leaving everything else untouched. Both operators take the same underlying data — a list of CIDR ranges or bare IPs, entered one per line — and the tool assembles the condition value the way AWS itself renders it: a single CIDR becomes a plain string, and two or more become a JSON array, exactly mirroring how AWS's own console and CLI output display these condition blocks rather than always wrapping the value in an unnecessary single-element array.
Each line you enter is checked against a basic CIDR shape — four dot-separated number groups, with an optional /prefix — and any line that does not match is surfaced in a clearly labeled warning rather than silently dropped from the list. This is deliberately a warning, not a block: the regex used is a shape check, not a full IP-semantics validator (it will not catch an out-of-range octet like 999, and it does not recognize IPv6 notation at all), so a line flagged as "unrecognized format" might still be entered into the final condition on purpose — you decide whether to fix it or leave it, rather than the tool silently discarding something you typed intentionally.
Beyond the IP condition, this is a standard Allow-statement builder: multi-line actions and resources fields, an optional Sid, and the same structural validator used throughout this tool category checking that the assembled document has a recognized Effect, a non-empty Action, and a Resource before the JSON is shown. What it does not do is validate against AWS's actual routing or VPC configuration, resolve or expand named CIDR ranges, or check whether the IP ranges you enter correspond to anything real — it is a condition-block builder, not a network validator, and the "unrecognized format" warning is the full extent of its input checking.
The output is a validated Allow statement with the correct IpAddress or NotIpAddress condition, ready to copy, download, or merge into a larger policy — assembled entirely in your browser, with the CIDR ranges you enter never leaving the page.