title: How to provide multiple StringNotEquals conditions in AWS policy?
body: <p>I am trying to write AWS S3 bucket policy that denies all traffic except when it comes from two VPCs. The policy I'm trying to write looks like the one below, with a logical AND between the two <code>StringNotEquals</code> (except it's an invalid policy):</p>
  
  <pre><code>{
     "Version": "2012-10-17",
     "Id": "Policy1415115909152",
     "Statement": [
       {
         "Sid": "Allow-access-only-from-two-VPCs",
         "Action": "s3:*",
         "Effect": "Deny",
         "Resource": ["arn:aws:s3:::my-bucket",
                      "arn:aws:s3:::my-bucket/*"],
         "Condition": {
           "StringNotEquals": {
             "aws:sourceVpc": "vpc-111bbccc"
           },
           "StringNotEquals": {
             "aws:sourceVpc": "vpc-111bbddd"
           }
         },
         "Principal": "*"
       }
     ]
  }
  </code></pre>
  
  <p>If I use this:</p>
  
  <pre><code>"StringNotEquals": {
         "aws:sourceVpc": ["vpc-111bbccc", "vpc-111bbddd"]
       }
  </code></pre>
  
  <p>then at least one of the string comparisons returns true and the S3 bucket is not accessible from anywhere.</p>