バケットポリシーを使ったS3 Bucketへのアクセス制御について ref: http://qiita.com/jobbin/items/b861d000426aa1e96880

file0.txt

{
    "Version": "2012-10-17",
    "Id": "Policy146935390****",
    "Statement": [
        {
            "Sid": "Stmt146935390****",
            "Effect": "Deny",
            "Principal": {
                "AWS": "arn:aws:iam::2847****1948:user/test-user1"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::jobbin-key"
        }
    ]
}

file1.txt

{
    "Version": "2012-10-17",
    "Id": "Policy146935390****",
    "Statement": [
        {
            "Sid": "Stmt146935390****",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": "arn:aws:iam::2847****1948:user/test-user1"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::jobbin-key"
        }
    ]
}

file2.txt

{
    "Version": "2012-10-17",
    "Id": "Policy146935390****",
    "Statement": [
        {
            "Sid": "Stmt146935390****",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": "arn:aws:iam::2847****1948:role/test-assumerole"
            },
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::jobbin-key"
        }
    ]
}

file3.txt

{
    "Version": "2012-10-17",
    "Id": "Policy146927794****",
    "Statement": [
        {
            "Sid": "Stmt146927793****",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::jobbin-key",
            "Condition": {
                "StringNotLike": {
                    "aws:userid": "AROAISXGEH----G266U2S:*"
                }
            }
        }
    ]
}

file4.txt

$ aws iam get-role --role-name test-assumerole
{
    "Role": {
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Action": "sts:AssumeRole",
                    "Effect": "Allow",
                    "Principal": {
                        "AWS": "arn:aws:iam::8918****5875:root"
                    }
                }
            ]
        },
        "RoleId": "AROAISXGEH----G266U2S",
        "CreateDate": "2016-07-24T11:31:00Z",
        "RoleName": "test-assumerole",
        "Path": "/",
        "Arn": "arn:aws:iam::2847****1948:role/test-assumerole"
    }
}