Question

A company stores per-user files in a single S3 bucket named 'corp-user-data', with each user's objects stored under a prefix matching their IAM user name (for example, 'home/alice/'). All employees authenticate as IAM users and assume no roles. The security team wants a single, maintainable identity-based policy attached to all users that grants each user full object access ONLY to their own prefix, without creating a separate policy per user. Which policy construct achieves this least-privilege requirement most efficiently?

Accepted Answer

Use an IAM policy with the ${aws:username} policy variable in the Resource ARN, such as 'arn:aws:s3:::corp-user-data/home/${aws:username}/*'.

Answer

Attach a bucket policy that lists each user as a principal and restricts them to their matching prefix.

Answer

Use an IAM policy with a Condition on s3:prefix equal to ${aws:userid} to scope each ListBucket and object call.

Answer

Create one IAM permission boundary per user that limits access to that user's prefix, then attach the boundaries individually.