title: Amazon S3 Bucket: Deny List, Read, Write to specific folder
body: <p>I am trying to limit a deny a specific user list, read, and write access to a specific folder in my bucket. I am able to allow the user to see other folders, but on adding a deny policy to the account (added through groups), I get an access denied message.</p>
  
  <p>This is what I have for the deny access:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:*"
        ],
        "Resource": "arn:aws:s3:::*"
      },
      {
        "Effect": "Deny",
        "Action": [
          "s3:ListBucket"
        ],
        "Resource": "arn:aws:s3:::myBucket",
        "Condition": {
          "StringLike": {
            "s3:prefix": "Admin/*"
          }
        }
      }
    ]
  }
  </code></pre>
  
  <p>In theory, I would like to limit a certain user to not be able to do the above regarding the Admin folder, however they still need to be able to view the bucket for other folders. </p>
  
  <p>I have also tried:</p>
  
  <pre><code>{
    "Id": "Policy",
    "Version": "2012-10-17",
    "Statement": [
      {
        "Sid": "Stmt1516743098844",
        "Action": [
          "s3:GetBucketLocation",
          "s3:PutObject",
          "s3:GetObject"
        ],
        "Effect": "Deny",
        "Resource": "arn:aws:s3:::mybucket/Admin/*",
        "Principal": {
          "AWS": [
            "arn:aws:iam::11111111:user/Jenny"
          ]
        }
      }
    ]
  }
  </code></pre>
  
  <p>Both of the above JSON statements were created using the Policy Generator for S3 Bucket Policy and IAM Policy.</p>
  
  <p>Any clue on how to deny list access to a folder but allow viewing the bucket?</p>