title: Add SSO user to condition for S3 bucket policy
body: <p>I am using SSO to login to root, prod and non prod account.
  I have s3 buckets in prod account where I want only few users to have full access.
  I tried to add in-policy in the permission set , but it is not working.</p>
  <p>I tried using assumed role that is in prod account which is created by SSO .</p>
  <p>what I am doing is below, but I get error that , put access is not granted.
  can you please let me know what is wrong here?</p>
  <pre><code>{
        &quot;Sid&quot;: &quot;S3FullAccess&quot;,
        &quot;Action&quot;: &quot;s3:*&quot;,
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Resource&quot;: [
              &quot;arn:aws:s3:::&lt;bucket-name&gt;&quot;,
              &quot;arn:aws:s3:::&lt;bucket-name&gt;/*&quot;
              ],
        &quot;Condition&quot;: {
          &quot;ArnEquals&quot;: {
            &quot;aws:PrincipalArn&quot;: [
                &quot;arn:aws:iam::&lt;account-id&gt;:role/aws-reserved/sso.amazonaws.com/eu-central-1/&lt;sso-role&gt;&quot;,
                &quot;arn:aws:sts::&lt;account-id&gt;:assumed-role/&lt;sso-role&gt;/&lt;sso-user&gt;&quot;
            ]
          }
        }
      }
  </code></pre>
  <p>in addition to this I tried the solution in this link but it also didn't help me
  <a href="https://stackoverflow.com/questions/64237574/s3-bucket-policy-for-sso-user">s3 bucket policy for sso user</a></p>