title: S3 policy that allows uploads to subfolder only from user's Cognito `sub`
body: <h2>Goals:</h2>
  
  <ul>
  <li>Limit uploads to specific set of subdirectories which helps the backend identify the reason for the upload: <code>/avatar/...</code>, <code>/cover/...</code></li>
  <li>Have a way to identify the upload's cognito user</li>
  <li>Prevent other users overriding content in this user's subfolder</li>
  </ul>
  
  <p>With that in mind, I can't figure out how to limit the user ability to upload only to subfolder with name derived from user's cognito <code>sub</code> identifier. Or any other string from which I can identify and fetch the user from the cognito pool.</p>
  
  <p>Example: <code>avatar/${aws:cognito-sub}/filename</code></p>
  
  <p>I found <code>aws:userid</code> in the docs but it <a href="http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html" rel="nofollow noreferrer">refers to</a>:</p>
  
  <blockquote>
    <p>role id:caller-specified-role-name</p>
    
    <p>where role id is the unique id of the role and the
    caller-specified-role-name is specified by the RoleSessionName
    parameter passed to the AssumeRoleWithWebIdentity request.</p>
  </blockquote>
  
  <p>More context: The upload is handled in a lambda. Lambda transforms the image, but then needs to save the transformations in a different s3 and reference them to the user inside dynamodb.</p>