S3 Access Auth Role

s3-folder-access.yml

- PolicyName: !Join ["-", [ "CognitoIDP", { Ref: AWS::StackName }, "S3-Access", "Policy"]]
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: "AllowListingPublicFiles"
            Effect: Allow
            Action: "s3:ListBucket"
            Condition:
              StringLike:
                "s3:prefix":
                  - "public-files/*"
            Resource: !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }]]
          
          - Sid: "AllowListingUserFiles"
            Effect: Allow
            Action: "s3:ListBucket"
            Condition: 
              StringLike:
                "s3:prefix":
                  - !Join ["", [ 'users/', '${cognito-identity.amazonaws.com:sub', '}/*']] 

            Resource:
              - !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }]]
          
          - Sid: "AllowReadAccessPublicFolder"
            Effect: Allow
            Action:
              - "s3:GetObject" 
            Resource:
              - !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }, '/public-files']]
              - !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }, '/public-files/*']]
          
          - Sid: "ReadWriteDeleteOwnFiles"
            Effect: Allow
            Action:
              - "s3:GetObject"
              - "s3:PutObject"
              - "s3:DeleteObject" 
            Resource:
              - !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }, '/users/', '${cognito-identity.amazonaws.com:sub', '}']]
              - !Join ["", [ "arn:aws:s3:::", { Ref: s3FileBucket }, '/users/', '${cognito-identity.amazonaws.com:sub', '}/*']]