S3 policy to allow by IP can't be changed

We have an S3 bucket with website content in it that's served to the public through a proxy cache. The access to the bucket is limited to the IPs used by the proxy. This is all working fine.

New IPs were recently added to the proxy, but we're not able to add those to the policy. Directly editing the policy gives a "permission denied" no matter what permissions the user has. We discovered that we could work around this by temporarily unblocking public access to the bucket. However, if we add new IPs, after re-blocking public access we discover that all requests are blocked. If we revert the changes to the policy back to the original list of IPs then it goes back to working.

The policy is fairly basic and looks like this (edited for privacy):

{
    "Version": "2012-10-17",
    "Id": "my-bucket",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::my-bucket/*",
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "23.235.32.0/20",
                        "43.249.72.0/22",
                        "103.244.50.0/24",
                        "103.245.222.0/23",
                        "103.245.224.0/24",
                        "104.156.80.0/20",
                        "140.248.64.0/18",
                        "140.248.128.0/17",
                        "146.75.0.0/17",
                        "151.101.0.0/16",
                        "157.52.64.0/18",
                        "167.82.0.0/17",
                        "167.82.128.0/20",
                        "167.82.160.0/20",
                        "167.82.224.0/20",
                        "172.111.64.0/18",
                        "185.31.16.0/22",
                        "199.27.72.0/21",
                        "199.232.0.0/16",
                        "2a04:4e40::/32",
                        "2a04:4e42::/32"
                    ]
                }
            }
        }
    ]
}

I think you might be bumping into this.

I believe if you have a large list of IPs, and you have block public access turned on at the account level, then you run into this edge case.

With BPA turned on, S3 checks policies to prevent people allowing 0/0 or similar. For large enough IP ranges or lists, the checks that S3 uses behind the scenes to determine 'public' will have too wide a range to check, and will time out or error.

If you can narrow down some of your ranges, or find another way to protect the data, you should be okay.