AWS S3存储桶策略白名单

我有一个存储桶策略，可将我的IP范围列入AWS白名单。我有一台运行Packer构建作业的EC2服务器，该服务器试图从存储桶中拉出一个对象403 Forbidden，但是即使运行该作业的EC2服务器的IP显然在白名单范围内，我也遇到了错误。即使wget从该CIDR范围内的计算机运行，我也会遇到相同的错误。我很困惑为什么会这样。该政策似乎还不错。以下是我的存储桶策略，服务器的IP和错误：

Bucket Policy:

{
    "Version": "2012-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
        {
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": [
                "arn:aws:s3:::xxxxxxx",
                "arn:aws:s3:::xxxxxxx/*"
            ],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "10.x.x.x/12"
                    ]
                }
            }
        }
    ]
}

Server IP:

10.x.x.x/32

Error:

ui,message,    amazon-ebs:     "msg": "Error downloading 
https://s3.amazonaws.com/xxxxx/yyyy.zip to C:\\temp\\xxx.zip Exception 
calling \"DownloadFile\" with \"2\" argument(s): \"The remote server 
returned an error: (403) Forbidden.\""