title: IAM policy attached to role not working
body: <p>I have a node application that is invoking assumeRoleWithWebIdentity in the following manner: </p>
  
  <pre><code>var params = {
     DurationSeconds: 3600,   
     RoleArn: "arn:aws:iam::role/my_test_role",
     RoleSessionName: "session_name",
     WebIdentityToken: req.body.id_token
  };
  
  
  
  sts.assumeRoleWithWebIdentity(params, function(err, data) {
  
      //create s3 client with data.Credentials.SecretAccessKey, AccessKeyId, sessionToken
      //call s3.listObjectsV2({Bucket: 'my-bucket'}).
  
  });
  </code></pre>
  
  <p>No, i have a role in IAM call my_test_role. Attached to that role is a policy called my_test_policy which looks as follows:</p>
  
  <pre><code>{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "s3:ListAllMyBuckets",
          "s3:GetBucketLocation"
        ],
        "Resource": "arn:aws:s3:::*"
      },
      {
        "Effect": "Allow",
        "Action": "s3:ListBucket",
        "Resource": "arn:aws:s3:::my_bucket",
        "Condition": {"StringLike": {"s3:prefix": [
          "",
          "home/",
          "home/BOB/*"
        ]}}
      },
      {
        "Effect": "Allow",
        "Action": "s3:*",
        "Resource": [
          "arn:aws:s3:::my_bucket/home/BOB",
          "arn:aws:s3:::my_bucket/home/BOB/*"
        ]
      }
    ]
  }
  </code></pre>
  
  <p>In s3, I have a bucket called my_bucket, and in that bucket is the folder home. In home are a bunch of user folders:</p>
  
  <pre><code>my_bucket/home/ALICE
  my_bucket/home/BOB
  my_bucket/home/MARY
  </code></pre>
  
  <p>When my node application lists objects, it lists all the objects in home. The intention with my policy is to limit the listing to the user that has assumed the role. So if BOB has assumed the role, he should only see my_bucket/home/BOB and nothing else. I'll eventually replace the hard coded 'BOB' in the policy with ${my_oidc_url:sub}. But before I get to that step, I thought I would just hardcode "BOB" and see if that works. It does not. The assumed roles sees all of the folders. Any suggestions? </p>