S3 - restricted bucket (by prefix) read-only template

s3-bucket-ro-restricted.json

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::{{bucket}}"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": "{{prefix}}/*"
                }
            }
        },
        {
            "Effect": "Allow",
                 "Action": [
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectExtended",
        "s3:GetObjectVersion"
      ],
            "Resource": [
                "arn:aws:s3:::{{bucket}}/{{prefix}}/",
                "arn:aws:s3:::{{bucket}}/{{prefix}}/*"
            ]
        }
    ]
}