AWS SFTP Transfer remote open("/file"): Permission denied - amazon-web-services

Question

I have a SFTP server setup in AWS Transfer Family tied to a S3 bucket and when the user tries uploading to it without IP restriction, it works. However, when IP restriction is added, we get a Permission denied error. (Some information has been deidentified for privacy reasons)
sftp> put file.pdf
Uploading file.pdf to /file.pdf
remote open("/file.pdf"): Permission denied
sftp>
Policy without IP restriction:
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:DescribeKey",
"kms:ReEncrypt*"
],
"Resource": "arn:aws:kms:us-east-1:XXXXX:key/XXXXX"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObjectVersion",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::data/*",
"arn:aws:s3:::data"
]
}
]
}
File upload successful. Cloudwatch logs without IP restriction:
2022-08-03T18:49:56.945-05:00 username.XXXX CONNECTED SourceIP=X.X.X.X User=username HomeDir=LOGICAL Client=SSH-2.0-OpenSSH_7.4 Role=arn:aws:iam::XXXX:role/TransferBucketRW Kex=ecdh-sha2-nistp256 Ciphers=chacha20-poly1305#openssh.com,chacha20-poly1305#openssh.com
2022-08-03T18:50:26.134-05:00 username.XXXX OPEN Path=/data/uploads/file.pdf Mode=CREATE|TRUNCATE|WRITE
2022-08-03T18:50:26.240-05:00 username.XXXX CLOSE Path=/data/uploads/file.pdf BytesIn=347971
Policy with IP restriction
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:DescribeKey",
"kms:ReEncrypt*"
],
"Resource": "arn:aws:kms:us-east-1:XXXX:key/XXXX"
},
{
"Sid": "VisualEditor1",
"Effect": "Allow",
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:DeleteObjectVersion",
"s3:ListBucket",
"s3:DeleteObject",
"s3:GetObjectVersion"
],
"Resource": [
"arn:aws:s3:::data/*",
"arn:aws:s3:::data"
],
"Condition": {
"Bool": {
"aws:ViaAWSService": "false"
},
"IpAddress": {
"aws:SourceIp": "X.X.X.X/32"
}
}
}
]
}
File upload failed. Cloudwatch Logs with IP restriction
2022-08-03T18:59:14.498-05:00 username.XXXX CONNECTED SourceIP=X.X.X>X User=username HomeDir=LOGICAL Client=SSH-2.0-OpenSSH_7.4 Role=arn:aws:iam::XXXXX:role/TransferBucketRW Kex=ecdh-sha2-nistp256 Ciphers=chacha20-poly1305#openssh.com,chacha20-poly1305#openssh.com
2022-08-03T18:59:39.323-05:00 username.XXXX ERROR Message="Access Denied" Operation=OPEN Path=/data/uploads/file.pdf Mode=CREATE|TRUNCATE|WRITE RequestID=P9S2XW6FNMAW9T4T S3ExtendedRequestID=Omk8mugElCEwQpv1zXQtflAk8kEnky2/LrsetgW03js4g64ZI2XCjp6i8zgQvDZBf+hAp8ZdLS0=
2022-08-03T18:59:39.323-05:00 username.XXXX ERROR Message="Access denied"
I can confirm that the IP in the policy matched the SourceIP seen in the Cloudwatch Logs. Wondering if I need add this IP restriction in the Trust Policy of the role in addition to this IAM policy.