title: Amazon S3 - Returns 403 error instead of 404 despite GetObject allowance
body: <p>I've set up my S3 bucket with <a href="https://pete.wtf/2012/05/01/how-to-setup-aws-s3-access-from-specific-ips/" rel="nofollow noreferrer">this tutorial</a> to only accept requests from specific IP addresses. But even though those IPs are allowed to do <code>GetObject</code>, they get 403 errors instead of 404 for any files that are missing.</p>
  
  <p>My updated bucket policy is (with fictitious IP addresses):</p>
  
  <pre><code>{
      "Version": "2012-10-17",
      "Id": "S3PolicyId1",
      "Statement": [
          {
              "Sid": "IPDeny",
              "Effect": "Deny",
              "Principal": "*",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::www.bucketname.com/*",
              "Condition": {
                  "NotIpAddress": {
                      "aws:SourceIp": [
                          "100.100.100.0/22",
                          "101.101.101.0/22"
                      ]
                  }
              }
          },
      {
        "Sid": "ListItems",
        "Effect": "Deny",
        "Principal": "*",
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::www.bucketname.com",
              "Condition": {
                  "NotIpAddress": {
                      "aws:SourceIp": [
                          "100.100.100.0/22",
                          "101.101.101.0/22"
                      ]
                  }
              }
      }
      ]
  }
  </code></pre>
  
  <p>(Updated with the <code>ListBucket</code> command, as pointed out by Mark B.)</p>
  
  <p>I've found several related questions here on SO (like <a href="https://stackoverflow.com/questions/19037664/how-do-i-have-an-s3-bucket-return-404-instead-of-403-for-a-key-that-does-not-e">this</a> and <a href="https://stackoverflow.com/questions/31593047/amazon-s3-403-forbidden-with-correct-bucket-policy">this</a>), but their solutions are based on giving <em>everyone</em> permission to access the bucket's contents. </p>
  
  <p>And that approach works, because if I lift my IP filter then 404 errors are given for missing files instead of 403. But that defeats the purpose of an IP filter.</p>
  
  <p>I learned <a href="https://stackoverflow.com/questions/19037664/how-do-i-have-an-s3-bucket-return-404-instead-of-403-for-a-key-that-does-not-e">here</a> that:</p>
  
  <blockquote>
    <p>S3 returns a 403 instead of a 404 when the user doesn't have
    permission to list the bucket contents.</p>
  </blockquote>
  
  <p>But I cannot find way to have the bucket generate 404 error codes for missing files <em>without</em> removing my IP whitelist filter. And that is with including the <code>GetObject</code> command for retrieving the objects and <code>ListBucket</code> for listing the objects.</p>
  
  <p>My reasoning is as follows: if the IP addresses are allowed to access the bucket's content, then shouldn't S3 generate a 404 error for these IPs instead of 403? How do I do that <em>without</em> removing my existing filter?</p>