How to deny all actions to a specific folder inside S3 bucket?

Question

Basically, this policy is for AWS Transfer Family. I need to deny all access to a specific folder inside the S3 bucket. I tried the below policy, but still I was able to list the contents of the folder. But it was denied for PUT and DELETE operations.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetBucketLocation",
        "s3:ListAllMyBuckets"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:ListBucketVersions",
        "s3:GetBucketAcl"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:GetObjectAcl",
        "s3:GetObjectVersionTagging",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersion"
      ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}/*"
      ]
    },
    {
      "Effect": "Deny",
      "Action": [
        "s3:*"
        ],
      "Resource": [
        "arn:aws:s3:::${bucket_name}/app/restricted",
        "arn:aws:s3:::${bucket_name}/app/restricted/*"
      ]
    }
  ]
}

Expected: aws s3 ls s3://sample_bucket/app/restricted/data - Access Denied

Behaviour: aws s3 ls s3://sample_bucket/app/restricted/data - Listing all the contents of the folder

Answer 1

The ListBucket operation (which lists objects within a bucket) is a bucket-level permission, so it ignores the path in the supplied Resource.

Instead, you can specify the path in a Condition parameter.

From Amazon S3 Bucket: Deny List, Read, Write to specific folder - Stack Overflow:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::${bucket_name}",
      "Condition": {
        "StringLike": {
          "s3:prefix": "app/restricted/*"
        }
      }
    }
  ]
}

This will Deny listing the contents of the bucket when the prefix is app/restricted/*. Add this statement to your existing policy, since it specifically applies to ListBucket. Keep your existing Deny statement since it applies to other operations, such as GetObject and PutObject (which do accept paths in the resource).