AWS S3 bucket default storage class

Question

I've been trying to change default storage class in one of my buckets to glacier for one user using IAM policy but unfortunately it does not work. Can someone tell me what i am doing wrong? Every uploaded file still use Standard storage class.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::$MY_ACCOUNT_ID:user/backup"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::private-backup/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-storage-class": "GLACIER"
                }
            }
        }
    ]
}

Answer 1

If your users or bucket has other policies that allow such uploads, you have to use explicit deny in your policy, not allow:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "statement1",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::$MY_ACCOUNT_ID:user/backup"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::private-backup/*",
            "Condition": {
                "StringNotEquals": {
                    "s3:x-amz-storage-class": "GLACIER"
                }
            }
        }
    ]
}