Thanks! it should be done more often, posting results. I can remember struggling finding s3 solutions.

I found countless questions but no real solution on how to have multiple subusers and buckets in one account while limiting access to a bucket to just one specific subuser.

Here’s how I managed to make it work:

``` { "Version": "2012-10-17", "Statement": [ { "Sid": "DenyAllUsersButOne", "Effect": "Deny", "Action": "s3:*", "Resource": [ "arn:aws:s3:::test-a", "arn:aws:s3:::test-a/*" ], "NotPrincipal": { "AWS": "arn:aws:iam:::user/<UID>:<ACCESSKEY>" } } ] } ```

I hope this might be useful for others as well.