Chapter 2. Adding additional constraints for IP-based AWS role assumption