title: Full access to AWS S3 bucket for all operations except for 1 folder
body: <p>I have a group policy that allows full access to several S3 buckets.</p>
  
  <p>This policy allows read and write to the bucket.</p>
  
  <p>The team that uses these buckets wants that one of the folders will be read-only for their group without the ability to write or delete its contents.</p>
  
  <p>How do I provide that while still allowing them to have full access to all the other folders?</p>