拒绝S3存储桶中特定文件夹的特定用户的权限

Question

In AWS S3, I have one bucket named "Environments" under that I have 4 folders named "sandbox", "staging", "prod1" and "prod2" respectively and the permission of the whole bucket is "public".

Now I want to restrict One AWS user named "developer" to write anything into "prod1" and "prod2" folder but it can view them.

Kindly help me out with this

Answer 1

Create below policy and attach to a user developer

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                        "s3:GetBucketLocation",
                        "s3:ListAllMyBuckets"
                      ],
            "Resource": "arn:aws:s3:::*"
        },
        {
            "Effect": "Allow",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::Environments",
                "arn:aws:s3:::Environments/sandbox/*",
                "arn:aws:s3:::Environments/staging/*",
            ]
        }
    ]
}

This policy allows to full permission to folder sandbox and staging, but restrict another folder to user developer