AWS S3 Bucket Policy - Access to specific objects

aws-s3-bucket-policy-access-to-specific-objects.json

{
    "Version": "2008-10-17",
    "Statement": [
        {
            "Sid": "AllowAccessToSpecificFoldersAndObjects",
            "Effect": "Allow",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111111111111:user/[iam-username]",
                    "arn:aws:iam::222222222222:root"
                ]
            },
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::[bucket-name]",
                "arn:aws:s3:::[bucket-name]/[folder-1]/*",
                "arn:aws:s3:::[bucket-name]/[folder-2]/[sub-folder-2]/*"
            ]
        },
        {
            "Sid": "DenyAccessToSpecificFoldersAndObjects",
            "Effect": "Deny",
            "Principal": {
                "AWS": [
                    "arn:aws:iam::111111111111:user/[iam-username]",
                    "arn:aws:iam::222222222222:root"
                ]
            },
            "Action": "s3:*",
            "Resource":  [
                "arn:aws:s3:::[bucket-name]"
            ],
            "Condition": {
                "StringNotLike": {
                    "s3:prefix": [
                        "[folder-1]/*",
                        "[folder-2]/[sub-folder-2]/*"
                    ]
                }
            }
        }
    ]
}