photo_backup_bucket_policy.json

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": [
               "mobileanalytics:PutEvents",
               "cognito-sync:*",
               "cognito-identity:*"
           ],
           "Resource": [
               "*"
           ]
       },
       {
           "Sid": "ListYourObjects",
           "Effect": "Allow",
           "Action": "s3:ListBucket",
           "Resource": [
               "arn:aws:s3:::your-actual-photo-bucket-name"
           ],
           "Condition": {
               "StringLike": {
                   "s3:prefix": [
                       "${cognito-identity.amazonaws.com:sub}/",
                       "${cognito-identity.amazonaws.com:sub}/*"
                   ]
               }
           }
       },
       {
           "Sid": "ReadYourObjects",
           "Effect": "Allow",
           "Action": [
               "s3:GetObject"
           ],
           "Resource": [
               "arn:aws:s3:::your-actual-photo-bucket-name/${cognito-identity.amazonaws.com:sub}",
               "arn:aws:s3:::your-actual-photo-bucket-name/${cognito-identity.amazonaws.com:sub}/*"
           ]
       }
   ]
}