Restricting console permissions in IAM for S3

Question

I want to be able to allow users created through IAM to be able to view one bucket in the management console. Furthermore, I want to restrict it to a folder within the bucket, such that the permissions would be:

S3 Console access for my-bucket/folder/*

How would I do this using the policy generator? I currently have:

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:*",
      "Resource": "*"
    }
  ]
}

However, when I modify the Resource location -- arn:aws:s3:::my-bucket/folder -- it prevents the user from being able to use the console at all. Is this possible to do and what do I need to do to be able to fix this?

Answer 1

You need to use conditions rather than adding the folder string to the resource, something like this...

"Resource":"arn:aws:s3:::mybucket"
"Condition":{
    "StringLike":{
            "s3:prefix":"folder/*"
    }
}