title: AWS S3 Policy wildcard ("*") works, but "s3:GetObject", "s3:PutObject", etc does not
body: <p>By following the example here <a href="http://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/s3-example-photo-album.html" rel="nofollow noreferrer">Uploading Photos to Amazon S3 from a Browser</a> I am able to upload files from my browser to my S3 bucket.  However, when I attempt to modify the policy to be more specific by addeing the following statement I get an access denied error:</p>
  
  <pre><code>{
          "Effect": "Allow",
          "Action": [
               "s3:GetObject",
              "s3:PutObject",
              "s3:DeleteObject"
          ],
          "Resource": [
              "arn:aws:s3:::[MY_BUCKET]/${cognito-identity.amazonaws.com:sub}",
              "arn:aws:s3:::[MY_BUCKET]/${cognito-identity.amazonaws.com:sub}*"
          ]
      }
  </code></pre>
  
  <p>However, the following statement does allow me to upload to the bucket:</p>
  
  <pre><code>{
          "Effect": "Allow",
          "Action": [
             "*"
          ],
          "Resource": [
              "arn:aws:s3::[MY_BUCKET]/${cognito-identity.amazonaws.com:sub}",
              "arn:aws:s3:::[MY_BUCKET]/${cognito-identity.amazonaws.com:sub}*"
          ]
      }
  </code></pre>
  
  <p>I am logging in my user using federated login and placing them into an AWS Identity pool.  The policy containing the above code is assumed by the Authenticated role of my Identity pool.  I've confirmed that this Identity ID exists in my Identity pool.  All my research tells me that I should be able to be more specific with my actions so I have no idea what is going wrong here.</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>I realized it might be useful to know how the files got in the bucket in the first place.  I'm using the aws-sdk from npm and the following code to upload image files to the bucket:</p>
  
  <pre><code>return new Promise(function (resolve, reject) {
          const fileName = userId + '/' + utilities.getGUID();
          s3.upload({
              Key: fileName,
              Body: file,
              ACL: 'public-read'
          }, function (err, data) {
              if (err) {
                  dropzoneUtilities.setDropzoneFileCanceled(file);
                  console.log(err);
                  reject(err);
              }
              else {
                  dropzoneUtilities.setDropzoneFileComplete(file);
                  dropzoneUtilities.removeFile(file);
                  resolve({ data, name: file.name});
              }
  
          });
      });
  </code></pre>