Restrict the AWS console to your gateway IP

AWS has no "allowed IPs" switch for the console. Instead, you attach an IAM policy that denies everything unless the request comes from your IP range — the aws:SourceIp condition. With your team exiting through one Reach gateway IP, that range is a single /32 per region.

The policy

Attach this as a customer-managed policy to the IAM group, role or Identity Center permission set your team uses. Replace the addresses with your gateway IP(s):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Sid": "DenyUnlessViaReachGateway",
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
      "NotIpAddress": { "aws:SourceIp": ["203.0.113.10/32", "203.0.113.11/32"] },
      "Bool": { "aws:ViaAWSService": "false" }
    }
  }]
}

This policy allows nothing by itself — it only adds a deny. Keep your existing allow policies alongside it.

The aws:ViaAWSService: false line matters: without it, actions AWS services perform on your behalf (CloudFormation creating resources, Lambda calling S3) would be denied because they don't come from your IP. With it, only your direct calls are checked.

Roll out safely

  1. Create the policy but attach it to a test user first.
  2. With Reach on and the AWS console routed (add amazonaws.com, aws.amazon.com and signin.aws.amazon.com to your routing policy), sign in as the test user. It should work.
  3. Switch Reach off and reload — you should get AccessDenied.
  4. Attach to the real groups/permission sets. Keep a break-glass admin without the policy, stored in a password manager, in case a gateway is unreachable.

What this covers — and doesn't

  • Covers: console actions, CLI/SDK calls, and anything else authenticated as the principal the policy is attached to, whether the traffic goes through Reach's routed browser or a terminal pointed at the local proxy.
  • Doesn't cover: the root user (attach nothing to root; lock it with MFA instead), calls made by AWS services on your behalf (exempted above), and resource-based policies on S3 buckets etc. — those need their own aws:SourceIp conditions if you want the same rule there.

Common questions

Will this break the AWS CLI on my laptop?

Only if the CLI isn't going through Reach. Set HTTPS_PROXY=http://127.0.0.1:8082 (see Use Reach with your terminal) or use a routed browser for console work.

Can I scope it to sensitive actions only?

Yes — replace "Action": "*" with the actions you care about (e.g. iam:*, ec2:*). The deny then only bites for those calls off-gateway.

Does aws:SourceIp see the gateway IP or my home IP?

The gateway's. AWS evaluates the public address the request arrives from; through Reach that's the exit IP shown on your dashboard.

Source: AWS: Denies access to AWS based on the source IP