title: Folder Specific IAM Permissions for boto3 S3 API Calls
body: <p>So I have a user whose IAM permissions are set to the following.  It is meant to only allow them Create/Delete/List/etc. objects in the "Target_Folder/" for the bucket.</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Statement": [
      {
          "Sid": "Stmt123456789",
          "Effect": "Allow",
          "Action": [
              "s3:CreateBucket",
              "s3:DeleteObject",
              "s3:GetObject",
              "s3:ListBucket",
              "s3:PutObject"
          ],
          "Resource": [
              "arn:aws:s3:::bucket/Target_Folder/*"
          ]
      }
    ]
  }
  </code></pre>
  
  <p>Using boto3, I embed the relevant aws_access_key_id and aws_secret_access_key in the config.  After doing this, I find I am unable to preform any actions within the "/Target_Folder/" such as:</p>
  
  <pre><code>import boto3
  import boto.s3.transfer
  #Need to manually import S3Transfer() for some reason.
  from boto.s3.transfer import S3Transfer 
  
  bucket = 'bucket'
  prefix = 'Test_Folder/'
  
  client = boto3.client(s3)
  
  #Attempt to print objects under the Target_Folder
  response = client.list_objects(Bucket = bucket, Prefix = prefix)
  for file in response['Contents']:
      print(file['key'])
  
  
  #Attempt to upload file
  transfer = S3Transfer(client)
  transfer.upload_file('C:/filepath/file', bucket, prefix)
  </code></pre>
  
  <p>Ultimately, no matter what approach, I receive a <code>"botocore.exceptions.ClientError: An error occured (SignatureDoesNotMatch)...."</code>.  Conversely, if I use a key/secret_key pair with much more open bucket permissions, I have no issues interacting with the API. </p>
  
  <p>Apologies if this has been answered or clarified in another thread, I could not find any good ones while searching.</p>