IAM Policy that gives programmatic access to list and perform actions on specific sub folder inside a S3 Bucket. All events must come from inside a specific VPC. Can also add programmatic listing of root and Console access.

AllowAlsoListingOfBucketRoot.json

{
    "Sid": "AllowListingOfBucketRoot",
    "Effect": "Allow",
    "Action": [
        "s3:ListBucket"
    ],
    "Resource": [
        "arn:aws:s3:::{{BUCKET_NAME}}"
    ],
    "Condition": {
        "StringEquals": {
            "s3:prefix": [
                "", "{{SUB_FOLDER_NAME}}/*"
            ],
            "ForAllValues:StringEquals": {
                "aws:SourceVpc": "{{VPC_ID}}"
            }
        }
    }
}

AllowConsoleAccess.json

{
    "Sid": "AllowUserToSeeBucketListInTheConsole",
    "Action": [
        "s3:ListAllMyBuckets",
        "s3:GetBucketLocation"
    ],
    "Effect": "Allow",
    "Resource": [
        "arn:aws:s3:::*"
    ]
}

ProgrammaticAccessToS3SubfolderOnly.json

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowListingOfSubFolder",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::{{BUCKET_NAME}}"
            ],
            "Condition": {
                "StringLike": {
                    "s3:prefix": [
                        "{{SUB_FOLDER_NAME}}/*"
                    ],
                    "ForAllValues:StringEquals": {
                        "aws:SourceVpc": "{{VPC_ID}}"
                    }
                }
            }
        },
        {
            "Sid": "AllowSomeActionsInSubFolder",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::{{BUCKET_NAME}}/{{SUB_FOLDER_NAME}}/*"
            ],
            "Condition": {
                "StringEquals": {
                    "aws:SourceVpc": "{{VPC_ID}}"
                }
            }
        }
    ]
}