AWS S3 policy: allow access from the specific IP address

To allow IP from a specific address, you may think in different way.
Lets, enable selected actions in a policy. Then create a denied policy as bellow and attach it to a group.

Result: Access from these listed IPs are allowed!

Example:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Deny",
            "Action": "s3:ListAllMyBuckets",
            "Resource": "*",
            "Condition": {
                "ForAnyValue:NotIpAddress": {
                    "aws:SourceIp": [
                        "103.230.93.95/26",
                        "103.231.89.4/26"
                    ]
                }
            }
        }
    ]
}