title: S3 policy - public write but only authenticated read
body: <p>What I am trying to do is to let (anonymous) users share files to a specified bucket. However, they should not be possible to READ the files, which are already there (and for all I care not even the ones they submitted themselves). The only account which should be able to list/get objects from the bucket should be the bucket owner. </p>
  
  <p>Here is what I got so far:</p>
  
  <pre><code>{
  "Version": "2012-10-17",
  "Id": "PutOnlyPolicy",
  "Statement": [
      {
          "Sid": "Allow_PublicPut",
          "Effect": "Allow",
          "Principal": "*",
          "Action": [
              "s3:PutObject",
              "s3:PutObjectAcl"
          ],
          "Resource": "arn:aws:s3:::myputbucket/*"
      },
      {
          "Sid": "Deny_Read",
          "Effect": "Deny",
          "Principal": "*",
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::myputbucket/*"
      },
      {
          "Sid": "Allow_BucketOwnerRead",
          "Effect": "Allow",
          "Principal": {
              "AWS": "arn:aws:iam::myAWSAccountID:root"
          },
          "Action": "s3:GetObject",
          "Resource": "arn:aws:s3:::myputbucket/*"
      }
  ]
  }
  </code></pre>
  
  <p>The above Policy enables me to write files to the bucket (f.e. via the android app S3anywhere), but I can't GET the objects, not even with my authenticated account. </p>
  
  <p>Do you have any hints on how I could accomplish this? Thanks!</p>