Simple IAM policy to allow a user to upload to an S3 bucket, locked down to their specific Cognito Identity

s3-upload-policy-restricted

{ 
    "Version": "2012-10-17", 
    "Statement": [ 
        { 
            "Effect": "Allow", 
            "Action": [ 
                "s3:PutObject" 
            ], 
            "Resource": [ 
                "arn:aws:s3:::UserUploads/${cognito-identity.amazonaws.com:sub}/*" 
            ] 
        } 
    ] 
}