policy.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfOwnState",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::my-terraform-state",
            "Condition": {
                "StringLike": {
                    "aws:userid": "<redacted>:*",
                    "s3:prefix": "accounts/111111111-*/*"
                }
            }
        },
        {
            "Sid": "AllowRWOfOwnState",
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:PutObject",
                "s3:GetObject"
            ],
            "Resource": "arn:aws:s3:::my-terraform-state/accounts/111111111-*/*",
            "Condition": {
                "StringLike": {
                    "aws:userid": "<redacted>:*"
                }
            }
        }
    ]
}

zz_example

$ aws s3 ls s3://my-terraform-state/accounts/999999999-org-owner/

An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
$ aws s3 ls s3://my-terraform-state/accounts/111111111-foo/
2017-05-16 13:57:51          0
2017-05-16 13:58:22         29 test
$ aws s3 ls s3://my-terraform-state/accounts/ --recursive

An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied