title: Role with policy that restricts access to folder in s3 bucket getting ignored
body: <p>I've got this policy (called &quot;backup&quot;) assigned to a role (called &quot;sync&quot;):</p>
  <pre><code>{
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;AllowSync&quot;,
              &quot;Action&quot;: [
                  &quot;s3:ListBucket&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::My_Bucket&quot;
              ],
              &quot;Condition&quot;: {
                  &quot;StringLike&quot;: {
                      &quot;s3:prefix&quot;: [
                          &quot;db_backups/example.com/*&quot;
                      ]
                  }
              }
          },
          {
              &quot;Sid&quot;: &quot;AllowGetPut&quot;,
              &quot;Action&quot;: [
                  &quot;s3:GetObject&quot;,
                  &quot;s3:PutObject&quot;
              ],
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::My_Bucket/db_backups/example.com/*&quot;
              ]
          }
      ]
  }
  </code></pre>
  <ol>
  <li><p>Before assigning the sync role containing the backup policy to an instance, the instance cannot access resources in the bucket. This is as expected.</p>
  </li>
  <li><p>After I assign the instance to they sync role, the instance can access objects in the designated folder in the policy. This is expected.</p>
  </li>
  <li><p>However, what's unexpected is that the instance now also has access to all objects in the bucket no matter what folder they are in. It's like the restrictions in place in the policy are getting ignore.</p>
  </li>
  </ol>
  <p>The bucket does not grant access to the public.</p>
  <p><strong>UPDATE</strong></p>
  <p>The problem appears to be related to a bucket policy I had in place:</p>
  <pre><code>
  {
      &quot;Version&quot;: &quot;2012-10-17&quot;,
      &quot;Id&quot;: &quot;Policy1607462323232&quot;,
      &quot;Statement&quot;: [
          {
              &quot;Sid&quot;: &quot;Stmt1&quot;,
              &quot;Effect&quot;: &quot;Allow&quot;,
              &quot;Principal&quot;: &quot;*&quot;,
              &quot;Action&quot;: [
                  &quot;s3:GetObject&quot;,
                  &quot;s3:PutObject&quot;,
                  &quot;s3:ListBucket&quot;
              ],
              &quot;Resource&quot;: [
                  &quot;arn:aws:s3:::My_Bucket&quot;,
                  &quot;arn:aws:s3:::My_Bucket/*&quot;
              ],
              &quot;Condition&quot;: {
                  &quot;StringEquals&quot;: {
                      &quot;aws:SourceVpce&quot;: &quot;vpce-aaaaadddddfffff&quot;
                  }
              }
          }
      ]
  </code></pre>