title: AWS: Restricting IAM User to Specific Folder in S3 Bucket
body: <p>So I've been trying to define a policy to restrict a group of IAM users to a particular folder in an S3 bucket with no success. I've riffed off the policy outlined in this blog post. <a href="http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke" rel="nofollow">http://blogs.aws.amazon.com/security/post/Tx1P2T3LFXXCNB5/Writing-IAM-policies-Grant-access-to-user-specific-folders-in-an-Amazon-S3-bucke</a></p>
  
  <p>Specifically I'm using the following:</p>
  
  <pre><code>{
   "Version":"2012-10-17",
   "Statement": [
     {
       "Sid": "AllowUserToSeeBucketListInTheConsole",
       "Action": ["s3:ListAllMyBuckets", "s3:GetBucketLocation"],
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::*"]
     },
    {
       "Sid": "AllowRootAndHomeListingOfCompanyBucket",
       "Action": ["s3:ListBucket"],
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::mybucket"],
       "Condition":{"StringEquals":{"s3:delimiter":["/"]}}
      },
     {
       "Sid": "AllowListingOfUserFolder",
       "Action": ["s3:ListBucket"],
       "Effect": "Allow",
       "Resource": ["arn:aws:s3:::mybucket"],
       "Condition":{"StringLike":{"s3:prefix":["myfolder"]}}
     },
     {
       "Sid": "AllowAllS3ActionsInUserFolder",
       "Effect": "Allow",
       "Action": ["s3:*"],
       "Resource": ["arn:aws:s3:::mybucket/myfolder/*"]
     }
   ]
  }
  </code></pre>
  
  <p>Unfortunately this policy for some reason allows users to navigate not only into the specified folder but other folders present in the same bucket. How do I restrict users in such a way that they can only navigate into the specified folder?</p>