AWS: Restricting IAM User to Specific Folder in S3 Bucket

Question

So I've been trying to define a policy to restrict a group of IAM users to a particular folder in an S3 bucket with no success. I've riffed off the policy outlined in this blog post. http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke

Specifically I'm using the following:

{
 "Version":"2012-10-17",
 "Statement": [
   {
     "Sid": "AllowUserToSeeBucketListInTheConsole",
     "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::*"]
   },
  {
     "Sid": "AllowRootAndHomeListingOfCompanyBucket",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::mybucket"],
     "Condition":{"StringEquals":{"s3:delimiter":["/"]}}
    },
   {
     "Sid": "AllowListingOfUserFolder",
     "Action": ["s3:ListBucket"],
     "Effect": "Allow",
     "Resource": ["arn:aws:s3:::mybucket"],
     "Condition":{"StringLike":{"s3:prefix":["myfolder"]}}
   },
   {
     "Sid": "AllowAllS3ActionsInUserFolder",
     "Effect": "Allow",
     "Action": ["s3:*"],
     "Resource": ["arn:aws:s3:::mybucket/myfolder/*"]
   }
 ]
}

Unfortunately this policy for some reason allows users to navigate not only into the specified folder but other folders present in the same bucket. How do I restrict users in such a way that they can only navigate into the specified folder?

Answer 1

I hope this documentation will help you out, the steps are broken down and quite simple to follow:

http://docs.aws.amazon.com/AmazonS3/latest/dev/walkthrough1.html

You can also use policy variables as well.

It lets you specify placeholders in a policy. When the policy is evaluated, the policy variables are replaced with values that come from the request itself. For example - ${aws:username}:

Further more you can also check out this Stackoverflow question (if seem relevant):

Preventing a user from even knowing about other users (folders) on AWS S3

Answer 2

I've answered this before, but I'll answer again from here. It's best to create a user then add them to a group then assign the group r/w to the bucket. This is a typical example of how write the policy

{
  "Statement": [
    {
      "Sid": "sidgoeshere",
      "Action": [
        "s3:DeleteObject",
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:ListBucket",
        "s3:PutObject"
      ],
      "Effect": "Allow",
      "Resource": [
        "arn:aws:s3:::s3bucket",
        "arn:aws:s3:::s3bucket/*"
      ]
    }
  ]
}