title: S3 bucket policy: In a Public Bucket, make a sub-folder private
body: <p>I have a bucket filled with contents that need to be mostly public. However, there is one folder (aka "prefix") that should only be accessible by an authenticated IAM user.</p>
  
  <pre><code>{
    "Statement": [
      {
        "Sid": "AllowIAMUser",
        "Action": [
          "s3:GetObject"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::bucket/prefix1/prefix2/private/*",
        "Principal": {
          "AWS": [
            "arn:aws:iam::123456789012:user/bobbydroptables"
          ]
        }
      },
      {
        "Sid": "AllowAccessToAllExceptPrivate",
        "Action": [
          "s3:GetObject",
          "s3:GetObjectVersion"
        ],
        "Effect": "Allow",
        "Resource": "arn:aws:s3:::bucket/*",
        "Condition": {
          "StringNotLike": {
            "s3:prefix": "prefix1/prefix2/private/"
          }
        },
        "Principal": {
          "AWS": [
            "*"
          ]
        }
      }
    ]
  }
  </code></pre>
  
  <p>When I try to save this policy I get the following error messages from AWS:</p>
  
  <pre><code>Conditions do not apply to combination of actions and resources in statement -
    Condition "s3:prefix"
    and action "s3:GetObject"
    in statement "AllowAccessToAllExceptPrivate"
  </code></pre>
  
  <p>Obviously this error applies specifically to the second statement. Is it not possible to use the "s3:prefix" condition with the "s3:GetObject" action?</p>
  
  <p>Is it possible to take one portion of a public bucket and make it accessible only to authenticated users?</p>
  
  <p>In case it matters, this bucket will only be accessed read-only via api.</p>
  
  <p>This question is similar to <a href="https://stackoverflow.com/questions/9798253/amazon-s3-bucket-policy-for-public-restrictions-only">Amazon S3 bucket policy for public restrictions only</a>, except I am trying to solve the problem by taking a different approach.</p>