IAM AWS S3 to restrict to a specific sub-folder
<p>I'm using AWS S3 component to store files. </p>

<p>I have a bucket called "<strong>mybucket</strong>" and with the following folders :</p>

<pre><code>+---Mybucket
\---toto1
\---toto2
+---toto3
|   \--- subfolder
|       \---subsubfolder
\---toto4
</code></pre>

<p>I have AWS console users that need only need to access "toto3" folder.</p>

<p>I tried to restrict the access to this folder, but the user must have the right to list the root of bucket. If I put additional rights to acces the root folder, users can browser "toto1" and "toto2" folders and I don't want.</p>

<p>I want to configure something like that: </p>

<ul>
<li>Authorize to list all buckets of my S3 account (listAllBuckets policy)</li>
<li>Autorize to list the root of the bucket (it's OK for me if the user see the directories names)</li>
<li>Deny access for all prefix bucket different from "toto3" </li>
<li>Autorize every actions for the user in toto3 folder</li>
<li>I don't want to write an inclusive rules</li>
</ul>

<p>I tried this IAM policy without any success :</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket",
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": ["arn:aws:s3:::mybucket/toto3/*"]
        },
        {
            "Sid": "Stmt1457617383000",
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket"
            ],
            "Resource": ["arn:aws:s3:::mybucket"]
        },
        {
            "Sid": "Stmt1457617230000",
            "Effect": "Deny",
            "Action": ["s3:*"],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": "toto3*"
                }
            },
            "Resource": [
                "arn:aws:s3:::mybucket/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListAllMyBuckets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
</code></pre>