Bucket policy that respects pre-signed URLs OR IP Address deny?
<p>I would like to be able to restrict access to files in a S3 bucket in multiple ways. This is due to the fact that the files stored can be accessed in different manners. We do this because we have TBs of files, so we don't want to duplicate the bucket.</p>

<p>One access method is through tokenized CDN delivery which uses the S3 bucket as a source. So that the files may be pulled, I've set the permissions for the files to allow download for everybody. Using a bucket policy, I can restrict IP addresses which can get the files in the bucket. So I've restricted them to the CDN IP block and anyone outside those IP addresses can't grab the file.</p>

<p>The other is access method is by direct downloads using our store system which generates S3 time expiring pre-signed URLS.</p>

<p>Since the CDN pull effectively needs the files to be publicly readable, is there a way to:</p>

<ol>
<li><p>Check first for a valid pre-signed URL and serve the file if the request is valid</p></li>
<li><p>If not valid, fall back to the IP address restriction to prevent further access?</p></li>
</ol>

<p>I've got a working IP restriction bucket policy working, but that stomps out the pre-signed access...removing the bucket policy fixes the pre-signed access but then the files are public.</p>