amazon-web-services - AWS. How to set permisson PutObject for folder, but not on whole container?

Question

Its about AWS-MediaStore service.

Try to add policy on user side:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSElementalMediaStoreGetAccess",
            "Effect": "Allow",
            "Action": "mediastore:GetObject",
            "Resource": "*"
        }
    ]
}

And for container side:

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Sid" : "MediaStorePostToSpecificPath",
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::CENSORED:root"
    },
    "Action" : "mediastore:PutObject",
    "Resource" : "arn:aws:mediastore:eu-central-1:CENSORED:container/test/path1/*",
    "Condition" : {
      "Bool" : {
        "aws:SecureTransport" : "true"
      }
    }
  } ]
}

But Post into Path1 tells me that Access Denied. Is it possible to setup policy that can provide PutObject for User into defined folder?

Answer 1

Dunno why, but after few attemps this configuration start working correctly: User:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSElementalMediaStore",
            "Effect": "Allow",
            "Action": [
                "mediastore:GetObject"
            ],
            "Resource": "*"
        }
    ]
}

Container:

{
  "Version" : "2012-10-17",
  "Statement" : [ {
    "Sid" : "MediaStoreAccess",
    "Effect" : "Allow",
    "Principal" : {
      "AWS" : "arn:aws:iam::CENSORED:user/bot"
    },
    "Action" : "mediastore:PutObject",
    "Resource" : "arn:aws:mediastore:eu-central-1:CENSORED:container/test/path1/*",
    "Condition" : {
      "Bool" : {
        "aws:SecureTransport" : "true"
      }
    }
  } ]
}

Now user bot can put files only in path1 folder. May be i got this issue because policy applies not so fast...