Allow access to one subfolder in a bucket, but not to list all buckets or the contents of the root folder

s3-sub-folder-deny.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAccess",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:ListBucketMultipartUploads",
                "s3:AbortMultipartUpload",
                "s3:ListBucket",
                "s3:DeleteObject",
                "s3:GetObjectVersion",
                "s3:ListMultipartUploadParts"
            ],
            "Resource": [
                "arn:aws:s3:::BucketName",
                "arn:aws:s3:::BucketName/FolderName/*"
            ]
        },
        {
            "Sid": "DenyAccess",
            "Effect": "Deny",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::BucketName",
            "Condition": {
                "ForAllValues:StringNotEquals": {
                    "s3:prefix": [
                        "FolderName",
                        "FolderName/",
                        "FolderName/*"
                    ]
                }
            }
        }
    ]
}