S3 bucket policy for cross-account terraform use

terraform_s3_policy.json

{
    "Version": "2012-10-17",
    "Id": "Policy1547233271159",
    "Statement": [
        {
            "Sid": "Allow-non-prod-to-list-bucket-objects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::222222222222:root"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::terraform-state-storage"
        },
        {
            "Sid": "Deny-non-prod-from-listing-bucket-objects-in-prod-folder",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::222222222222:root"
            },
            "Action": [
                "s3:ListBucket",
                "s3:ListBucketVersions"
            ],
            "Resource": "arn:aws:s3:::terraform-state-storage",
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "env:/prod/*"
                    ]
                }
            }
        },
        {
            "Sid": "Allow-non-prod-users-to-CRUD-bucket-objects",
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::222222222222:root"
            },
            "Action": [
                "s3:DeleteObject",
                "s3:DeleteObjectVersion",
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:RestoreObject"
            ],
            "Resource": "arn:aws:s3:::terraform-state-storage/*"
        },
        {
            "Sid": "Deny-non-prod-users-from-objects-in-prod-folder",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::222222222222:root"
            },
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::terraform-state-storage/env:/prod/*"
        }
    ]
}

Props to @magnetikonline for clueing me into the right condition syntax: https://gist.github.com/magnetikonline/6215d9e80021c1f8de12