doesnotwork.json

    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "arn:aws:iam::99999999999:role/AppRole",
                    "arn:aws:iam::99999999999:role/AdminRole"
                  ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ]
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
              "AWS": [
                  "arn:aws:iam::99999999999:role/AppRole",
                  "arn:aws:iam::99999999999:role/AdminRole"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ]
        }
    ]
}

doesworkbutnotgeneric.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Deny",
            "NotPrincipal": {
                "AWS": [
                    "99999999999"
                    "arn:aws:iam::99999999999:role/AppRole",
                    "arn:aws:iam::99999999999:role/AdminRole",
                    "arn:aws:iam::99999999999:assumed-role/AdminRole/andy.gelnar"
                  ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ]
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
              "AWS": [
                  "99999999999"
                  "arn:aws:iam::99999999999:role/AppRole",
                  "arn:aws:iam::99999999999:role/AdminRole",
                  "arn:aws:iam::99999999999:assumed-role/AdminRole/andy.gelnar"
                ]
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ]
        }
    ]
}

worksbutomgwhai.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "",
            "Effect": "Deny",
            "Principal": {
                "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ],
            "Condition": {
                "StringNotLike": {
                    "aws:userId": [
                        "99999999999"
                        "ARO[APPROLEID]FWERFVR",
                        "ARO[ADMINROLEID]QEFEW:*"
                    ]
                }
            }
        },
        {
            "Sid": "",
            "Effect": "Allow",
            "Principal": {
              "AWS": "*"
            },
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::my-awesome-bucket/*",
                "arn:aws:s3:::my-awesome-bucket"
            ],
            "Condition": {
                "StringLike": {
                    "aws:userId": [
                        "99999999999"
                        "ARO[APPROLEID]FWERFVR",
                        "ARO[ADMINROLEID]QEFEW:*"
                    ]
                }
            }
        }
    ]
}