Как ограничить доступ к бакету Object Storage диапазоном IP-адресов, принадлежащих Cloud CDN

import argparse
import ipaddress
import json
import urllib.request

parser = argparse.ArgumentParser()
parser.add_argument("--bucket", required=True)
parser.add_argument("--source", required=True)
args = parser.parse_args()

with urllib.request.urlopen(args.source, timeout=30) as response:
    prefixes = json.load(response)["prefixes"]

if not prefixes:
    raise ValueError("Список подсетей CDN пуст")

networks = [ipaddress.ip_network(prefix) for prefix in prefixes]
cidrs = []
for version in (4, 6):
    cidrs.extend(
        str(network)
        for network in ipaddress.collapse_addresses(
            network for network in networks if network.version == version
        )
    )

policy = {
    "Version": "2012-10-17",
    "Statement": [{
        "Sid": "AllowCloudCDNOnly",
        "Effect": "Allow",
        "Principal": "*",
        "Action": "s3:GetObject",
        "Resource": f"arn:aws:s3:::{args.bucket}/*",
        "Condition": {"IpAddress": {"aws:SourceIp": cidrs}},
    }],
}
print(json.dumps(policy, indent=2, ensure_ascii=False))