title: AWS IAM Policies: How do I alter the AWSLambdaFullAccess policy to only allow access to one S3 bucket?
body: <p>I'm working with my IT team to restrict my user account (under a root account) so that it doesn't have access to S3 buckets I don't want access to. When enabling the AWSLambdaFullAccess policy, it enables full access to a lot of AWS features, including all of S3. Here is the AWSLambdaFullAccess policy:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "cloudwatch:*",
          "cognito-identity:ListIdentityPools",
          "cognito-sync:GetCognitoEvents",
          "cognito-sync:SetCognitoEvents",
          "dynamodb:*",
          "events:*",
          "iam:ListAttachedRolePolicies",
          "iam:ListRolePolicies",
          "iam:ListRoles",
          "iam:PassRole",
          "kinesis:DescribeStream",
          "kinesis:ListStreams",
          "kinesis:PutRecord",
          "lambda:*",
          "logs:*",
          "s3:*",
          "sns:ListSubscriptions",
          "sns:ListSubscriptionsByTopic",
          "sns:ListTopics",
          "sns:Subscribe",
          "sns:Unsubscribe"
        ],
        "Resource": "*"
      }
    ]
  }
  </code></pre>
  
  <p>Most of that is fine. How would I alter this as a new policy so that I only have access to the "arn:aws:s3:::lambda-scripts" bucket?</p>