title: Cognito / S3 User Specific Policies
body: <p>I am using the AWS SDK for Android alongside Cognito to authenticate users (via Login With Amazon) to my AWS resources. What I am <em>attempting</em> to do is to setup an S3 bucket like so:</p>
  
  <pre><code>./my-bucket
    ├── first_user@email.com
    └── second_user@email.com
  </code></pre>
  
  <p>So, the <code>my-bucket</code> bucket will have folders based on the user's e-mail address.</p>
  
  <p>My first stab to setup the policy was as such:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["s3:ListBucket"],
        "Resource": ["arn:aws:s3:::my-bucket"]
      },
      {
        "Effect": "Allow",
        "Action": [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ],
        "Resource": [
          "arn:aws:s3:::my-bucket/${www.amazon.com:user_id}",
          "arn:aws:s3:::my-bucket/${www.amazon.com:user_id}/*"
        ]
      }
    ]
  }
  </code></pre>
  
  <p>As a test, I am trying to download a folder for a user like so:</p>
  
  <pre class="lang-java prettyprint-override"><code>final Map logins = new HashMap();
  logins.put("www.amazon.com", token);
  credentialsProvider.withLogins(logins);
  
  final TransferManager transferManager = new TransferManager(credentialsProvider);
  MultipleFileDownload download = transferManager.downloadDirectory("my-bucket", "first_user@email.com", new File("/sdcard/Download"));
  </code></pre>
  
  <p>However, when I run this I get a "Forbidden" exception. If I modify the policy to explicitly reference <code>first_user@email.com</code> rather than <code>${www.amazon.com:user_id}</code> it works fine.</p>
  
  <h2>Question</h2>
  
  <ol>
  <li>Is this even possible to be able to use the LWA user's e-mail address to configure it like this?</li>
  <li>Is there a way to log actually <em>what</em> parameters are happening when I make a request?</li>
  </ol>
  
  <p>I've seen references <a href="http://docs.aws.amazon.com/STS/latest/UsingSTS/CreatingWIF.html#CreatingWIF-userid" rel="nofollow">like this</a> but I'm not sure which ones actually apply. It would be fantastic if I were somehow able to <strong>see</strong> what values are coming across when I make a request.</p>
  
  <p>Thanks in advance.</p>