A few minor changes to this section (basically just a few missing "the"s):

Riak CS supports two keys to be used with these conditions: `aws:SecureTransport` and `aws:SourceIp`.  `aws:SecureTransport` is used with the `Bool` condition to check whether the request was sent with SSL. Accepted values for this key are `true` and `false`. `aws:SourceIp` is used with the `IpAddress` and `NotIpAddress` conditions, and represents the requester's IP address.  IPv4 IP addresses in CIDR notation are supported.

The IP address to be compared with `IpAddress` or `NotIpAddress` is taken from the source IP address of the TCP connection. If Riak CS is behind a load balancer that does not preserve source IP address and bucket policies related to IP addresses, Riak CS can be configured to adopt IP address described in the `X-Forwarded-For` request header, which should be added by the load balancer. Set `trust_x_forwarded_for` to `true` in `app.config` when the header can be trusted and secure. The default is `false`, where Riak CS uses the source IP address of the TCP connection.